@noy-db/hub 0.6.0-pre.9 → 0.6.0

package/dist/chunk-BRVW2GS5.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-sync/presence.ts","../src/with-sync/period-scope.ts","../src/with-sync/engine.ts","../src/with-sync/transaction.ts"],"sourcesContent":["/**\n * Presence handle — real-time awareness of who is viewing/editing a collection.\n * encrypted ephemeral channel keyed by collection DEK via HKDF.\n *\n * The presence key is derived from the collection DEK so:\n *  - The adapter never learns user identities from presence payloads.\n *  - Presence rotates automatically when the DEK rotates (revoked users\n *    can no longer participate after a DEK rotation).\n *\n * Two transport strategies:\n *  1. **Pub/sub** (real-time): used when the adapter implements\n *     `presencePublish` and `presenceSubscribe`.\n *  2. **Storage-poll** (fallback): presence records are written to a\n *     reserved `_presence_<collection>` collection on the sync adapter\n *     (if available) or local adapter, and polled periodically.\n */\n\nimport type { NoydbStore, PresencePeer } from '../kernel/types.js'\nimport { encrypt, decrypt, derivePresenceKey, type EnclaveKey } from '../kernel/enclave/index.js'\n\nconst subtle = globalThis.crypto.subtle\n\n/**\n * HKDF salt domain for the presence-tag key — the adapter-opaque record-id\n * tag used by the storage-poll fallback. Domain-separated from the presence\n * PAYLOAD key (`'noydb-presence'`, in `derivePresenceKey`) so the tag key\n * and the payload encryption key are cryptographically independent even\n * though both derive from the same collection DEK.\n */\nconst PRESENCE_TAG_KEY_DOMAIN = 'noydb.presence.tag.v1'\n\n/** Options for constructing a PresenceHandle. @internal */\nexport interface PresenceHandleOpts {\n  /** Local adapter for storage-poll fallback. */\n  adapter: NoydbStore\n  /** Remote (sync) adapter — preferred for broadcasting presence if available. */\n  syncAdapter?: NoydbStore\n  /** Vault name — used as part of the channel and storage key. */\n  vault: string\n  /** Collection name — used as HKDF `info` and channel suffix. */\n  collectionName: string\n  /**\n   * Calling user's ID. In encrypted mode it is encrypted inside the\n   * storage-poll record's `data` field — the record id is an\n   * adapter-opaque HMAC tag, not the userId, so the adapter never learns\n   * peer identities. Unencrypted vaults have no key to tag or encrypt\n   * with, so the userId is used as the record id in cleartext (dev posture\n   * only — identity privacy requires encryption).\n   */\n  userId: string\n  /** Whether encryption is active. When false, presence payloads are stored as JSON. */\n  encrypted: boolean\n  /** Callback that resolves the collection DEK (used to derive the presence key). */\n  getDEK: (collectionName: string) => Promise<EnclaveKey>\n  /** How long (ms) before a peer's presence is considered stale. Default: 30_000. */\n  staleMs?: number\n  /** Poll interval (ms) for the storage-poll fallback. Default: 5_000. */\n  pollIntervalMs?: number\n}\n\n/**\n * Internal storage envelope for the storage-poll fallback.\n * Written to `_presence_<collection>` as `{ lastSeen, iv, data }`.\n *\n * In encrypted mode `data` is ciphertext of `{ userId, payload }` — the\n * userId rides inside the encrypted payload, never as a top-level field, and\n * the record's storage id is a separate HMAC tag (see `presenceTag`), not\n * the userId. In unencrypted mode `data` is `JSON.stringify(payload)` and\n * the record id IS the (cleartext) userId — there is no key to tag with.\n */\ninterface StoragePresenceRecord {\n  lastSeen: string\n  iv: string    // base64 AES-GCM IV (empty when not encrypted)\n  data: string  // base64 ciphertext or JSON string when not encrypted\n}\n\n/** Presence handle for a single collection. */\nexport class PresenceHandle<P> {\n  private readonly adapter: NoydbStore\n  private readonly syncAdapter: NoydbStore | undefined\n  private readonly vault: string\n  private readonly collectionName: string\n  private readonly userId: string\n  private readonly encrypted: boolean\n  private readonly getDEK: (collectionName: string) => Promise<EnclaveKey>\n  private readonly staleMs: number\n  private readonly pollIntervalMs: number\n  private readonly channel: string\n  private readonly storageCollection: string\n\n  private presenceKey: EnclaveKey | null = null\n  private presenceTagKey: EnclaveKey | null = null\n  private subscribers: Array<(peers: PresencePeer<P>[]) => void> = []\n  private unsubscribePubSub: (() => void) | null = null\n  private pollTimer: ReturnType<typeof setInterval> | null = null\n  private stopped = false\n\n  constructor(opts: PresenceHandleOpts) {\n    this.adapter = opts.adapter\n    this.syncAdapter = opts.syncAdapter\n    this.vault = opts.vault\n    this.collectionName = opts.collectionName\n    this.userId = opts.userId\n    this.encrypted = opts.encrypted\n    this.getDEK = opts.getDEK\n    this.staleMs = opts.staleMs ?? 30_000\n    this.pollIntervalMs = opts.pollIntervalMs ?? 5_000\n    // Channel used by pub/sub adapters — vault-scoped so two collections\n    // in the same vault don't bleed into each other's presence channels.\n    this.channel = `${opts.vault}:${opts.collectionName}:presence`\n    // Reserved collection name for the storage-poll fallback.\n    this.storageCollection = `_presence_${opts.collectionName}`\n  }\n\n  /**\n   * Announce yourself (or update your cursor/status).\n   * Encrypts `payload` with the presence key and publishes it.\n   */\n  async update(payload: P): Promise<void> {\n    if (this.stopped) return\n\n    const key = await this.getPresenceKey()\n    const now = new Date().toISOString()\n    const plaintext = JSON.stringify({ userId: this.userId, lastSeen: now, payload })\n    let encryptedPayload: string\n\n    if (this.encrypted && key) {\n      const { iv, data } = await encrypt(plaintext, key)\n      encryptedPayload = JSON.stringify({ iv, data })\n    } else {\n      encryptedPayload = plaintext\n    }\n\n    // Pub/sub path — publish to any adapter that supports it\n    const pubAdapter = this.getPubSubAdapter()\n    if (pubAdapter?.presencePublish) {\n      await pubAdapter.presencePublish(this.channel, encryptedPayload)\n    }\n\n    // Storage-poll path — write a record to the storage adapter\n    await this.writeStorageRecord(payload, now)\n  }\n\n  /**\n   * Subscribe to presence updates. The callback receives a filtered, decrypted\n   * list of all currently-active peers (excluding yourself, excluding stale).\n   *\n   * Returns an unsubscribe function. Also call `stop()` to release all resources.\n   */\n  subscribe(cb: (peers: PresencePeer<P>[]) => void): () => void {\n    if (this.stopped) return () => {}\n\n    this.subscribers.push(cb)\n\n    // Start pub/sub listener on first subscriber\n    if (this.subscribers.length === 1) {\n      this.startListening()\n    }\n\n    return () => {\n      this.subscribers = this.subscribers.filter(s => s !== cb)\n      if (this.subscribers.length === 0) this.stopListening()\n    }\n  }\n\n  /** Stop all listening and clear resources. */\n  stop(): void {\n    this.stopped = true\n    this.stopListening()\n    this.subscribers = []\n  }\n\n  // ─── Private ────────────────────────────────────────────────────────\n\n  private async getPresenceKey(): Promise<EnclaveKey | null> {\n    if (!this.encrypted) return null\n    if (!this.presenceKey) {\n      try {\n        const dek = await this.getDEK(this.collectionName)\n        this.presenceKey = await derivePresenceKey(dek, this.collectionName)\n      } catch {\n        // no-op — presence degrades gracefully if crypto fails\n      }\n    }\n    return this.presenceKey\n  }\n\n  /**\n   * Derive (and cache) the presence-tag key — a non-extractable, sign-only\n   * HMAC-SHA256 key HKDF-derived from the collection DEK, domain-separated\n   * from the presence payload key by {@link PRESENCE_TAG_KEY_DOMAIN}.\n   * Mirrors `deriveClassifyIndexKey` (kernel/enclave/classify/bidx.ts). No\n   * PBKDF2 stretch — the adapter never holds this key, so a plain keyed HMAC\n   * tag is sufficient and deterministic. Returns `null` when unencrypted\n   * (no DEK to derive from).\n   */\n  private async getPresenceTagKey(): Promise<EnclaveKey | null> {\n    if (!this.encrypted) return null\n    if (!this.presenceTagKey) {\n      try {\n        const dek = await this.getDEK(this.collectionName)\n        const rawDek = await subtle.exportKey('raw', dek)\n        const hkdfKey = await subtle.importKey('raw', rawDek, 'HKDF', false, ['deriveBits'])\n        const salt = new TextEncoder().encode(PRESENCE_TAG_KEY_DOMAIN)\n        const info = new TextEncoder().encode(this.collectionName)\n        const bits = await subtle.deriveBits({ name: 'HKDF', hash: 'SHA-256', salt, info }, hkdfKey, 256)\n        this.presenceTagKey = await subtle.importKey('raw', bits, { name: 'HMAC', hash: 'SHA-256' }, false, ['sign'])\n      } catch {\n        // no-op — presence degrades gracefully if crypto fails\n      }\n    }\n    return this.presenceTagKey\n  }\n\n  /**\n   * Deterministic, adapter-opaque tag for `userId` — used as the\n   * storage-poll record id in encrypted mode so the adapter never sees the\n   * userId. Falls back to the raw `userId` when unencrypted (no key exists\n   * to tag with — see {@link PresenceHandleOpts.userId}).\n   *\n   * Signs directly via `subtle.sign` (like `bidx.ts`'s `mintAt`) rather than\n   * the barrel's `hmacSha256Hex` helper: that helper re-exports its key\n   * argument's raw bytes internally, which only works for extractable keys\n   * (e.g. an AES-GCM DEK) — `presenceTagKey` is deliberately non-extractable.\n   */\n  private async presenceTag(userId: string): Promise<string> {\n    const tagKey = await this.getPresenceTagKey()\n    if (!tagKey) return userId\n    const mac = await subtle.sign('HMAC', tagKey, new TextEncoder().encode(userId) as BufferSource)\n    return Array.from(new Uint8Array(mac)).map((b) => b.toString(16).padStart(2, '0')).join('')\n  }\n\n  private getPubSubAdapter(): NoydbStore | undefined {\n    // Prefer the sync adapter (it broadcasts to other devices)\n    if (this.syncAdapter?.presencePublish) return this.syncAdapter\n    if (this.adapter.presencePublish) return this.adapter\n    return undefined\n  }\n\n  private startListening(): void {\n    const pubAdapter = this.getPubSubAdapter()\n\n    if (pubAdapter?.presenceSubscribe) {\n      // Real-time pub/sub path\n      this.unsubscribePubSub = pubAdapter.presenceSubscribe(\n        this.channel,\n        (encryptedPayload) => { void this.handlePubSubMessage(encryptedPayload) },\n      )\n    } else {\n      // Storage-poll fallback\n      this.pollTimer = setInterval(\n        () => { void this.pollStoragePresence() },\n        this.pollIntervalMs,\n      )\n      // Kick off an immediate poll\n      void this.pollStoragePresence()\n    }\n  }\n\n  private stopListening(): void {\n    if (this.unsubscribePubSub) {\n      this.unsubscribePubSub()\n      this.unsubscribePubSub = null\n    }\n    if (this.pollTimer) {\n      clearInterval(this.pollTimer)\n      this.pollTimer = null\n    }\n  }\n\n  private async handlePubSubMessage(encryptedPayload: string): Promise<void> {\n    try {\n      const peer = await this.decryptPresencePayload(encryptedPayload)\n      if (!peer || peer.userId === this.userId) return\n\n      const cutoff = new Date(Date.now() - this.staleMs).toISOString()\n      if (peer.lastSeen < cutoff) return\n\n      // Deliver only this new peer to subscribers; a full snapshot poll follows\n      // on next interval. For pub/sub, we could maintain a map of active peers,\n      // but for simplicity: emit a snapshot read from storage.\n      await this.pollStoragePresence()\n    } catch {\n      // Decrypt failure — stale key or tampered payload, ignore\n    }\n  }\n\n  private async decryptPresencePayload(\n    encryptedPayload: string,\n  ): Promise<{ userId: string; lastSeen: string; payload: P } | null> {\n    const key = await this.getPresenceKey()\n\n    if (!this.encrypted || !key) {\n      return JSON.parse(encryptedPayload) as { userId: string; lastSeen: string; payload: P }\n    }\n\n    const { iv: ivB64, data } = JSON.parse(encryptedPayload) as { iv: string; data: string }\n    const plaintext = await decrypt(ivB64, data, key)\n    return JSON.parse(plaintext) as { userId: string; lastSeen: string; payload: P }\n  }\n\n  private async writeStorageRecord(payload: P, now: string): Promise<void> {\n    const key = await this.getPresenceKey()\n    let iv = ''\n    let data: string\n    let recordId: string\n\n    if (this.encrypted && key) {\n      // userId rides INSIDE the ciphertext, like the pub/sub path — the\n      // adapter never sees it. The record id is a separate deterministic\n      // tag, also opaque to the adapter.\n      const plaintext = JSON.stringify({ userId: this.userId, payload })\n      const result = await encrypt(plaintext, key)\n      iv = result.iv\n      data = result.data\n      recordId = await this.presenceTag(this.userId)\n    } else {\n      // Unencrypted vault — no key exists to tag or encrypt with.\n      data = JSON.stringify(payload)\n      recordId = this.userId\n    }\n\n    const record: StoragePresenceRecord = { lastSeen: now, iv, data }\n    const json = JSON.stringify(record)\n\n    // Use the sync adapter if available (so other devices can read it);\n    // fall back to local adapter.\n    const storeAdapter = this.syncAdapter ?? this.adapter\n    const envelope = {\n      _noydb: 1 as const,\n      _v: 1,\n      _ts: now,\n      _iv: '',\n      _data: json,\n    }\n    try {\n      await storeAdapter.put(\n        this.vault,\n        this.storageCollection,\n        recordId,\n        envelope,\n      )\n    } catch {\n      // Presence write failure is non-fatal — the user is still present locally\n    }\n  }\n\n  private async pollStoragePresence(): Promise<void> {\n    if (this.stopped || this.subscribers.length === 0) return\n\n    try {\n      const key = await this.getPresenceKey()\n      const storeAdapter = this.syncAdapter ?? this.adapter\n      const ids = await storeAdapter.list(this.vault, this.storageCollection)\n      const cutoff = new Date(Date.now() - this.staleMs).toISOString()\n      const peers: PresencePeer<P>[] = []\n      const myTag = await this.presenceTag(this.userId)\n\n      for (const id of ids) {\n        if (id === myTag) continue // skip ourselves\n        const envelope = await storeAdapter.get(this.vault, this.storageCollection, id)\n        if (!envelope) continue\n\n        try {\n          const record = JSON.parse(envelope._data) as StoragePresenceRecord\n          if (record.lastSeen < cutoff) continue\n\n          let peerUserId: string\n          let peerPayload: P\n          if (this.encrypted && key && record.iv) {\n            const plaintext = await decrypt(record.iv, record.data, key)\n            const decoded = JSON.parse(plaintext) as { userId: string; payload: P }\n            peerUserId = decoded.userId\n            peerPayload = decoded.payload\n          } else {\n            // Unencrypted mode: the record id IS the userId (see writeStorageRecord).\n            peerUserId = id\n            peerPayload = JSON.parse(record.data) as P\n          }\n\n          peers.push({ userId: peerUserId, payload: peerPayload, lastSeen: record.lastSeen })\n        } catch {\n          // One bad record (e.g. a pre-fix record that fails to decrypt\n          // under a new reader) shouldn't blank the whole snapshot — skip\n          // just this record.\n          continue\n        }\n      }\n\n      for (const cb of this.subscribers) {\n        cb(peers)\n      }\n    } catch {\n      // Poll failure is non-fatal\n    }\n  }\n}\n","/**\n * #807 — period-scoped pull support for the `SyncEngine` (thin-client\n * bootstrap: first sync pulls the current period + the period summaries;\n * historical periods backfill on demand via `pull({ periods: ['<name>'] })`).\n *\n * ## Membership law\n *\n * The engine only ever sees ciphertext envelopes, so period membership at\n * the sync tier is by write-time `_ts` against the closed periods' windows\n * (`periodExclusiveUpperBound`) — the SAME store-tier law freeze (#604) and\n * archive (#613) use, NOT the business-date (`dateField`) seal the write\n * guard applies inside the trust boundary. A late-booked record (in-period\n * business date, current write-time) therefore syncs with the current\n * period — mirroring how it archives at the NEXT period's archive.\n *\n * Closed periods partition the timeline by their exclusive upper bounds:\n * the earliest closed period's window is unbounded below (a close seals\n * everything at-or-before its `endDate`), each later one starts at its\n * predecessor's bound, and the CURRENT window is everything at-or-after\n * the latest closed bound (everything, when no period was ever closed).\n *\n * ## What a period filter can never drop\n *\n * - **Period summaries** (`_periods` + freeze/archive/target-purge\n *   companions) — the navigation index; always pulled in full, exempt from\n *   every filter (`collections`, `periods`, `modifiedSince`).\n * - **Delete markers and tombstones** — an erasure or delete must never be\n *   skipped by partial sync (the #589/#590 law, mirroring the\n *   `modifiedSince` exemption). This is what makes a device that never\n *   pulled period P converge instead of resurrecting P's deleted records\n *   when it later backfills.\n * - **Reserved lookups** (`_dict_*`/`_lookup_*`) — vocabulary/config rows\n *   are not period-partitioned data; their explicit pull loop is exempt.\n *\n * Push is NEVER period-filtered — `PushOptions` has no `periods` member at\n * all; a thin client's writes always flow up in full.\n */\nimport type { EncryptedEnvelope } from '../kernel/types.js'\nimport { ValidationError } from '../kernel/errors.js'\nimport { isTombstoneShape, isDeleteMarker } from '../kernel/enclave/index.js'\nimport {\n  PERIODS_COLLECTION,\n  PERIOD_FREEZES_COLLECTION,\n  PERIOD_ARCHIVES_COLLECTION,\n  PERIOD_TARGET_PURGES_COLLECTION,\n  periodExclusiveUpperBound,\n} from '../with-audit/periods/window.js'\n\nexport { PERIODS_COLLECTION }\n\n/**\n * The reserved period-metadata collections a period-scoped pull always\n * fetches first (phase 1, \"summaries\"): the hash-chained `_periods` index\n * plus its freeze/archive/target-purge companions.\n */\nexport const PERIOD_SUMMARY_COLLECTIONS: readonly string[] = [\n  PERIODS_COLLECTION,\n  PERIOD_FREEZES_COLLECTION,\n  PERIOD_ARCHIVES_COLLECTION,\n  PERIOD_TARGET_PURGES_COLLECTION,\n]\n\n/** The subset of a decrypted `PeriodRecord` the window computation needs. */\nexport interface PeriodSyncRecord {\n  readonly name: string\n  readonly kind: 'closed' | 'opened'\n  readonly endDate: string\n}\n\n/**\n * Vault-injected source of decrypted period records, wired via\n * `SyncEngine.setPeriodPullSource` (same injection pattern as\n * `setReservedLookupSource`). MUST re-read from the local store on every\n * call — the engine invokes it right after the summaries phase applied\n * freshly pulled `_periods` envelopes.\n */\nexport interface PeriodPullSource {\n  periods(): Promise<readonly PeriodSyncRecord[]>\n}\n\nconst SHAPE_MSG =\n  'pull: `periods` must be an array of closed-period names, or `{ current: true }`.'\n\n/** Validate the raw `PullOptions.periods` value (runtime shape only). */\nexport function validatePeriodsOption(\n  periods: unknown,\n): asserts periods is readonly string[] | { readonly current: true } {\n  if (Array.isArray(periods)) {\n    for (const p of periods) {\n      if (typeof p !== 'string' || p.length === 0) throw new ValidationError(SHAPE_MSG)\n    }\n    return\n  }\n  if (\n    typeof periods === 'object' && periods !== null &&\n    (periods as { current?: unknown }).current === true &&\n    Object.keys(periods).length === 1\n  ) {\n    return\n  }\n  throw new ValidationError(SHAPE_MSG)\n}\n\n/**\n * Resolve the selected `_ts` windows and return the pull-scope predicate:\n * `true` = the envelope is in scope for this pull. Tombstones and delete\n * markers are unconditionally in scope (see module doc).\n *\n * Throws `ValidationError` for a name that is not a closed period in the\n * (freshly synced) `_periods` index — a typo'd backfill must fail loudly,\n * never silently pull nothing.\n */\nexport function buildPeriodScope(\n  option: readonly string[] | { readonly current: true },\n  records: readonly PeriodSyncRecord[],\n): (envelope: EncryptedEnvelope) => boolean {\n  const closed = records\n    .filter((r) => r.kind === 'closed')\n    .map((r) => ({ name: r.name, bound: periodExclusiveUpperBound(r.endDate) }))\n    .sort((a, b) => a.bound.localeCompare(b.bound))\n\n  let windows: ReadonlyArray<{ lower: string | null; upper: string | null }>\n  if (Array.isArray(option)) {\n    windows = (option as readonly string[]).map((name) => {\n      const idx = closed.findIndex((c) => c.name === name)\n      if (idx < 0) {\n        const other = records.find((r) => r.name === name)\n        throw new ValidationError(\n          other\n            ? `pull: period \"${name}\" is \"${other.kind}\" — only closed periods have a backfill window; use \\`{ current: true }\\` for the open period.`\n            : `pull: no closed period named \"${name}\" in this vault's _periods index.`,\n        )\n      }\n      return { lower: idx > 0 ? closed[idx - 1]!.bound : null, upper: closed[idx]!.bound }\n    })\n  } else {\n    // { current: true } — everything at-or-after the latest closed bound\n    // (everything, when no period was ever closed: with no closed periods\n    // there is nothing historical to exclude, so nothing is silently dropped).\n    windows = [{ lower: closed.length > 0 ? closed[closed.length - 1]!.bound : null, upper: null }]\n  }\n\n  return (envelope: EncryptedEnvelope): boolean => {\n    if (isTombstoneShape(envelope) || isDeleteMarker(envelope)) return true\n    return windows.some(\n      (w) =>\n        (w.lower === null || envelope._ts >= w.lower) &&\n        (w.upper === null || envelope._ts < w.upper),\n    )\n  }\n}\n","import type {\n  NoydbStore,\n  DirtyEntry,\n  Conflict,\n  ConflictStrategy,\n  CollectionConflictResolver,\n  PushOptions,\n  PullOptions,\n  PushResult,\n  PullResult,\n  SyncStatus,\n  EncryptedEnvelope,\n  SyncMetadata,\n  SyncTargetRole,\n  ErasureEnforcement,\n} from '../kernel/types.js'\nimport { NOYDB_SYNC_VERSION } from '../kernel/types.js'\nimport { isConflictError, ValidationError } from '../kernel/errors.js'\nimport {\n  PERIOD_SUMMARY_COLLECTIONS,\n  PERIODS_COLLECTION,\n  buildPeriodScope,\n  validatePeriodsOption,\n  type PeriodPullSource,\n} from './period-scope.js'\nimport type { NoydbEventEmitter } from '../kernel/events.js'\nimport type { SyncPolicy } from '../kernel/sync-policy.js'\nimport { SyncScheduler } from '../kernel/sync-policy.js'\nimport { isTombstoneShape, isDeleteMarker, envelopeBodySize } from '../kernel/enclave/index.js'\n\n/** #650 Task 4 (#647) — the declared reserved-lookup (`_dict_*`/`_lookup_*`) collection-name\n *  registry a `SyncEngine` enumerates on pull. Explicit, not a blanket underscore-glob — other\n *  `_`-prefixed namespaces keep their `loadAll`-skip semantics untouched. */\nexport interface ReservedLookupSource {\n  /** Declared reserved-lookup collection names to enumerate on pull. */\n  collections(): readonly string[]\n}\n\n/** Sync engine: dirty tracking, push, pull, conflict resolution, scheduling. */\nexport class SyncEngine {\n  private readonly local: NoydbStore\n  private readonly remote: NoydbStore\n  private readonly strategy: ConflictStrategy\n  private readonly emitter: NoydbEventEmitter\n  private readonly vault: string\n  readonly role: SyncTargetRole\n  readonly label: string | undefined\n  /** #948: the resolved policy this engine was constructed with, retained for\n   *  introspection (`Noydb.listSyncTargets()`) — otherwise lost once consumed\n   *  into the scheduler below. */\n  readonly policy: SyncPolicy | undefined\n\n  private dirty: DirtyEntry[] = []\n  private lastPush: string | null = null\n  private lastPull: string | null = null\n  private loaded = false\n  private autoSyncInterval: ReturnType<typeof setInterval> | null = null\n  private isOnline = true\n\n  /** Sync scheduler. Manages push/pull timing. */\n  readonly scheduler: SyncScheduler | null\n\n  /** Per-collection conflict resolvers registered by Collection instances. */\n  private readonly conflictResolvers = new Map<string, CollectionConflictResolver>()\n\n  /**\n   * Expands a collection-name filter to include its satellite pair partner(s)\n   * (spec #591 convergence rule 5b) — wired from vault satellite declaration\n   * via `setPairExpander`. `undefined` when no satellite has ever been\n   * declared for this vault: identity behavior, zero change for non-satellite\n   * users.\n   */\n  private pairExpander?: (names: readonly string[]) => readonly string[]\n\n  /** #598: refreshes Collection in-memory views after a sync-applied local write. Wired by the\n   *  vault at open. `action` (#640): `'delete'` for a pulled tombstone/delete-marker, `'put'`\n   *  otherwise — classified at `applyRemote`, the one choke point that holds the envelope. */\n  private cacheInvalidator?: (collection: string, id: string, action: 'put' | 'delete') => Promise<void>\n\n  /** Wire the Collection-cache invalidation hook (#598). Same injection pattern as `setPairExpander`. */\n  setCacheInvalidator(fn: (collection: string, id: string, action: 'put' | 'delete') => Promise<void>): void {\n    this.cacheInvalidator = fn\n  }\n\n  /** #638 Task 4: opens/flushes the vault's graph-dispatch touch batch around a whole `pull()`/\n   *  `push()` call, so N `applyRemote`d records feeding the same derivation/rollup/MV target\n   *  recompute once. Wired by the vault at open, mirroring `cacheInvalidator`. */\n  private graphBatchController?: { begin(): void; flush(): Promise<void> }\n\n  /** Wire the graph-dispatch batch controller (#638 Task 4). Same injection pattern as `setCacheInvalidator`. */\n  setGraphBatchController(controller: { begin(): void; flush(): Promise<void> }): void {\n    this.graphBatchController = controller\n  }\n\n  /** #650 Task 4 (#647): declared reserved-lookup collections `pull()` enumerates explicitly (the\n   *  store's `list()` does not skip `_`-prefixed names, unlike `loadAll()`). Wired by the vault at\n   *  open, same injection pattern as `setCacheInvalidator`/`setGraphBatchController`. */\n  private reservedLookup?: ReservedLookupSource\n\n  /** Wire the reserved-lookup source (#650 Task 4). */\n  setReservedLookupSource(source: ReservedLookupSource): void {\n    this.reservedLookup = source\n  }\n\n  /** #653: expands a (pair-expanded) collection-name filter to include the reserved `_dict_*`\n   *  collections those names depend on via their lookup fields — mirrors `pairExpander` so a\n   *  partial `push`/`pull({collections:[...]})` never drops the dictionary a named collection's\n   *  labels/membership rely on. Wired unconditionally from the vault's `dictKeyFieldRegistry` via\n   *  `setReservedDictExpander` (returns `[]` when the vault has no dict-backed collections); only\n   *  `undefined` on a standalone engine that was never vault-attached. */\n  private reservedDictExpander?: (names: readonly string[]) => readonly string[]\n\n  /** Wire the reserved-dict expansion function (#653). Same injection pattern as `setPairExpander`. */\n  setReservedDictExpander(expander: (names: readonly string[]) => readonly string[]): void {\n    this.reservedDictExpander = expander\n  }\n\n  /** #807: vault-injected source of decrypted period records — resolves the `_ts` windows a\n   *  `pull({ periods })` scopes to. Re-read AFTER the summaries phase, so a fresh device's\n   *  freshly pulled `_periods` index is what the windows are computed from. `undefined` on a\n   *  standalone engine that was never vault-attached (period-scoped pull then throws). */\n  private periodPullSource?: PeriodPullSource\n\n  /** Wire the period-window source (#807). Same injection pattern as `setReservedLookupSource`. */\n  setPeriodPullSource(source: PeriodPullSource): void {\n    this.periodPullSource = source\n  }\n\n  /** #807: KPI accumulator `applyRemote` feeds during a period-scoped `pull()` — pointed at the\n   *  active phase's counters (summaries → records) and cleared before pull returns. Approximate\n   *  by design: a push interleaved mid-pull on the same engine would attribute its converge\n   *  applies to the open phase; the counters are a download-budget KPI, not an audit source. */\n  private pullByteSink: { records: number; bytes: number } | null = null\n\n  constructor(opts: {\n    local: NoydbStore\n    remote: NoydbStore\n    vault: string\n    strategy: ConflictStrategy\n    emitter: NoydbEventEmitter\n    syncPolicy?: SyncPolicy\n    role?: SyncTargetRole\n    label?: string\n  }) {\n    this.local = opts.local\n    this.remote = opts.remote\n    this.vault = opts.vault\n    this.strategy = opts.strategy\n    this.emitter = opts.emitter\n    this.role = opts.role ?? 'sync-peer'\n    this.label = opts.label\n    this.policy = opts.syncPolicy\n\n    // Create a scheduler when the policy asks for ANY automatic behaviour.\n    // #897: this used to test `push.mode !== 'manual'` alone, so a policy of\n    // `{ push: manual, pull: interval }` silently got no scheduler and its pull\n    // mode was ignored.\n    const policy = opts.syncPolicy\n    if (policy && (policy.push.mode !== 'manual' || policy.pull.mode !== 'manual')) {\n      this.scheduler = new SyncScheduler(policy, {\n        push: () => this.push().then(() => {}),\n        // #618 — role-gate the SCHEDULER-INITIATED pull. The Noydb layer gates\n        // pull-from-sink for explicit calls, but the scheduler calls the engine\n        // directly and would bypass it: a backup/archive-only primary with an\n        // `interval`/`on-focus` pull policy would pull ungated, reintroducing\n        // #616. This guards the engine self-initiating on a timer; an explicit\n        // `engine.pull()` still pulls for every role.\n        // `collections` is set by a 'phased' sequence — one collection per phase.\n        // A role-gated skip reports 'incomplete': nothing was pulled, so the\n        // phase must not mark its collection ready.\n        pull: (collections) =>\n          this.role === 'sync-peer'\n            ? this.pull(collections ? { collections: [...collections] } : undefined)\n                // PullResult.errors accumulates WITHOUT throwing, so a partial\n                // failure is only visible here — not via a rejected promise.\n                .then(r => (r.errors.length === 0 ? 'complete' : 'incomplete'))\n            : Promise.resolve('incomplete'),\n        getDirtyCount: () => this.dirty.length,\n      })\n    } else {\n      this.scheduler = null\n    }\n  }\n\n  /** Start the sync scheduler. Called after vault is fully opened. */\n  startScheduler(): void {\n    this.scheduler?.start()\n  }\n\n  /** Stop the sync scheduler. Called on close. */\n  stopScheduler(): void {\n    this.scheduler?.stop()\n  }\n\n  /**\n   * Register a per-collection conflict resolver.\n   * Called by Collection when `conflictPolicy` is set.\n   *\n   * Pair-coupled (#591 rule 5b): registering for one satellite-pair member\n   * registers the same resolver for both — the pair converges under one\n   * resolution policy. Expands with whatever the pair-expander knows *at this\n   * call*; resolvers registered before their pair existed are covered by\n   * `remirrorPairResolvers` at pair-registration time.\n   */\n  registerConflictResolver(collection: string, resolver: CollectionConflictResolver): void {\n    for (const n of this.pairExpander?.([collection]) ?? [collection]) this.conflictResolvers.set(n, resolver)\n  }\n\n  /**\n   * Wire a satellite pair-expansion function (vault registration, #591 Task 11).\n   * The closure re-reads the live `SatelliteRegistry` on every call, so pairs\n   * declared after this is set are still picked up by `push`/`pull` filters.\n   */\n  setPairExpander(expander: (names: readonly string[]) => readonly string[]): void {\n    this.pairExpander = expander\n  }\n\n  /**\n   * Retroactively mirror per-collection conflict resolvers across a newly\n   * registered satellite pair (#591 rule 5b) — covers the NORMAL declaration\n   * order, where the base's `conflictPolicy` resolver was registered before\n   * the satellite was declared (so the call-time expansion in\n   * `registerConflictResolver` saw no pair yet). Tie-break: when BOTH members\n   * already carry (different) resolvers, the FIRST name in `names` wins —\n   * callers pass `[base, satellite]`, so the base's resolver is canonical.\n   * Idempotent; a later explicit registration on either member still\n   * overwrites both (last-wins, via the call-time expansion above).\n   */\n  remirrorPairResolvers(names: readonly string[]): void {\n    const canonical = names.map(n => this.conflictResolvers.get(n)).find(r => r !== undefined)\n    if (!canonical) return\n    for (const n of names) this.conflictResolvers.set(n, canonical)\n  }\n\n  /** Record a local change for later push. */\n  async trackChange(collection: string, id: string, action: 'put' | 'delete', version: number): Promise<void> {\n    await this.ensureLoaded()\n\n    // Deduplicate: if same collection+id already in dirty, update it\n    const idx = this.dirty.findIndex(d => d.collection === collection && d.id === id)\n    const entry: DirtyEntry = {\n      vault: this.vault,\n      collection,\n      id,\n      action,\n      version,\n      timestamp: new Date().toISOString(),\n    }\n\n    if (idx >= 0) {\n      this.dirty[idx] = entry\n    } else {\n      this.dirty.push(entry)\n    }\n\n    await this.persistMeta()\n\n    // Notify scheduler of the write (triggers on-change or debounce)\n    this.scheduler?.notifyChange()\n  }\n\n  /** Remove a dirty entry (satellite fan-out revert cleanup — spec #591). */\n  async removeDirty(collection: string, id: string): Promise<void> {\n    const before = this.dirty.length\n    this.dirty = this.dirty.filter(d => !(d.collection === collection && d.id === id))\n    if (this.dirty.length !== before) await this.persistMeta()\n  }\n\n  /** Push dirty records to remote adapter. Accepts optional `PushOptions` for partial sync. */\n  async push(options?: PushOptions): Promise<PushResult> {\n    await this.ensureLoaded()\n    this.graphBatchController?.begin() // #638 Task 4\n\n    let pushed = 0\n    const conflicts: Conflict[] = []\n    const erasures: ErasureEnforcement[] = []\n    const errors: Error[] = []\n    const completed: number[] = []\n\n    // Partial sync: expand the filter to cover satellite pair partners (#591 rule 5b), then the\n    // reserved `_dict_*` collections those (expanded) names depend on (#653) — a locally-dirty\n    // dict edit pushes alongside push({collections:['orders']}), symmetric with pull below.\n    const expanded = options?.collections ? (this.pairExpander?.(options.collections) ?? options.collections) : null\n    const filter = expanded ? new Set([...expanded, ...(this.reservedDictExpander?.(expanded) ?? [])]) : null\n\n    for (let i = 0; i < this.dirty.length; i++) {\n      const entry = this.dirty[i]!\n\n      // Partial sync: skip collections not in the filter\n      if (filter && !filter.has(entry.collection)) {\n        continue\n      }\n\n      try {\n        if (entry.action === 'delete') {\n          await this.remote.delete(this.vault, entry.collection, entry.id)\n          completed.push(i)\n          pushed++\n        } else {\n          const envelope = await this.local.get(this.vault, entry.collection, entry.id)\n          if (!envelope) {\n            // Record was deleted locally after being marked dirty\n            completed.push(i)\n            continue\n          }\n\n          if (isTombstoneShape(envelope)) {\n            // #590: a tombstone push is an erasure assertion — unconditional,\n            // no CAS, no conflict resolution. Erasure always wins.\n            await this.remote.put(this.vault, entry.collection, entry.id, envelope)\n            completed.push(i)\n            pushed++\n            continue\n          }\n\n          try {\n            await this.remote.put(\n              this.vault,\n              entry.collection,\n              entry.id,\n              envelope,\n              entry.version - 1,\n            )\n            completed.push(i)\n            pushed++\n          } catch (err) {\n            if (isConflictError(err)) {\n              const remoteEnvelope = await this.remote.get(this.vault, entry.collection, entry.id)\n              if (remoteEnvelope) {\n                if (isTombstoneShape(remoteEnvelope)) {\n                  // #590: remote already shredded this record — enforce locally,\n                  // never resolve. Resolvers must not overrule an erasure.\n                  await this.applyRemote(entry.collection, entry.id, remoteEnvelope)\n                  erasures.push(this.reportErasure(entry.collection, entry.id, remoteEnvelope, envelope, 'push'))\n                  completed.push(i)\n                } else if (\n                  remoteEnvelope._v === envelope._v &&\n                  isDeleteMarker(remoteEnvelope) !== isDeleteMarker(envelope) &&\n                  !this.conflictResolvers.get(entry.collection)\n                ) {\n                  // #589: a same-_v delete-vs-edit tie on the push channel. handleConflict's db-level\n                  // 'version' default would resolve it to local-wins; the tie rule consults ONLY the\n                  // per-collection resolver, else delete-wins. (When a per-collection resolver IS set,\n                  // fall through to handleConflict, which already honors it — incl. the merged case.)\n                  if (isDeleteMarker(remoteEnvelope)) {\n                    // remote already deleted → converge locally, drop our (edit) push\n                    await this.applyRemote(entry.collection, entry.id, remoteEnvelope)\n                    completed.push(i)\n                  } else {\n                    // our local is the marker → force the delete onto the remote (unconditional put)\n                    await this.remote.put(this.vault, entry.collection, entry.id, envelope)\n                    completed.push(i)\n                    pushed++\n                  }\n                } else {\n                  const { handled, conflict } = await this.handleConflict(\n                    entry.collection,\n                    entry.id,\n                    envelope,\n                    remoteEnvelope,\n                    'push',\n                  )\n                  conflicts.push(conflict)\n                  if (handled === 'local') {\n                    // #936: supersede, don't overwrite in place — see advancePastRemote.\n                    const winner = this.advancePastRemote(conflict.local, remoteEnvelope)\n                    await this.remote.put(this.vault, entry.collection, entry.id, winner)\n                    if (winner !== conflict.local) await this.applyRemote(entry.collection, entry.id, winner)\n                    completed.push(i)\n                    pushed++\n                  } else if (handled === 'remote') {\n                    await this.applyRemote(entry.collection, entry.id, conflict.remote)\n                    completed.push(i)\n                  } else if (handled === 'merged' && conflict.local !== envelope) {\n                    // Merged envelope is stored in conflict.local (the winner)\n                    const merged = conflict.local\n                    await this.remote.put(this.vault, entry.collection, entry.id, merged)\n                    await this.applyRemote(entry.collection, entry.id, merged)\n                    completed.push(i)\n                    pushed++\n                  }\n                  // handled === 'deferred': leave in dirty log\n                }\n              }\n            } else {\n              throw err\n            }\n          }\n        }\n      } catch (err) {\n        errors.push(err instanceof Error ? err : new Error(String(err)))\n      }\n    }\n\n    // Remove completed entries from dirty log (reverse order to preserve indices)\n    for (const i of completed.sort((a, b) => b - a)) {\n      this.dirty.splice(i, 1)\n    }\n\n    this.lastPush = new Date().toISOString()\n    try {\n      await this.persistMeta()\n    } finally {\n      // #644 item 1: flush (which clears `_graphBatch` unconditionally, vault.ts:1316-1320) must\n      // run even if `persistMeta()` throws — else a throw here leaves the batch open, corrupting\n      // the NEXT pull()/push() call's wave with THIS call's stale touches.\n      await this.graphBatchController?.flush() // #638 Task 4\n    }\n\n    const result: PushResult = { pushed, conflicts, errors, erasures }\n    this.emitter.emit('sync:push', result)\n    return result\n  }\n\n  /** Pull remote records to local adapter. Accepts optional `PullOptions` for partial sync. */\n  async pull(options?: PullOptions): Promise<PullResult> {\n    await this.ensureLoaded()\n\n    let pulled = 0\n    const conflicts: Conflict[] = []\n    const erasures: ErasureEnforcement[] = []\n    const errors: Error[] = []\n\n    // ── #807 period-scoped pull: validate the option, sync the period summaries\n    // (`_periods` + companions — the navigation index, ALWAYS pulled in full,\n    // exempt from every filter), then resolve the selected `_ts` windows from the\n    // freshly synced index. All BEFORE the graph batch opens, so an invalid\n    // option throws without leaving a batch dangling; summary applies route\n    // through `applyRemote` like any pull (reserved names have no Collection\n    // instance, so the invalidator/graph seams are no-ops for them). ──\n    let periodScope: ((envelope: EncryptedEnvelope) => boolean) | null = null\n    let phases: { summaries: { records: number; bytes: number }; records: { records: number; bytes: number } } | null = null\n    if (options?.periods !== undefined) {\n      validatePeriodsOption(options.periods)\n      if (!this.periodPullSource) {\n        throw new ValidationError(\n          'period-scoped pull requires a vault-attached sync engine (open the vault via createNoydb + openVault).',\n        )\n      }\n      phases = { summaries: { records: 0, bytes: 0 }, records: { records: 0, bytes: 0 } }\n      let remotePeriodCount = 0\n      this.pullByteSink = phases.summaries\n      try {\n        for (const collName of PERIOD_SUMMARY_COLLECTIONS) {\n          for (const id of await this.remote.list(this.vault, collName)) {\n            if (collName === PERIODS_COLLECTION) remotePeriodCount++\n            try {\n              const remoteEnvelope = await this.remote.get(this.vault, collName, id)\n              if (!remoteEnvelope) continue\n              const localEnvelope = await this.local.get(this.vault, collName, id)\n              if (!localEnvelope || remoteEnvelope._v > localEnvelope._v) {\n                await this.applyRemote(collName, id, remoteEnvelope)\n                pulled++\n              }\n            } catch (err) {\n              errors.push(err instanceof Error ? err : new Error(String(err)))\n            }\n          }\n        }\n      } finally {\n        this.pullByteSink = null\n      }\n      const periodRecords = await this.periodPullSource.periods()\n      if (remotePeriodCount > 0 && periodRecords.length === 0) {\n        throw new ValidationError(\n          'period-scoped pull: the vault holds _periods records but none are readable — enable the ' +\n            'periods service (`periodsStrategy: withPeriods()`) so pull can resolve the period windows.',\n        )\n      }\n      periodScope = buildPeriodScope(options.periods, periodRecords)\n    }\n\n    this.graphBatchController?.begin() // #638 Task 4\n    if (phases) this.pullByteSink = phases.records\n\n    // Partial sync: expand the filter to cover satellite pair partners (#591 rule 5b), then the\n    // reserved `_dict_*` collections those (expanded) names depend on (#653) — adopters never\n    // name `_dict_*` in a `collections` filter, so a named collection's lookup-field dependency\n    // must be pulled alongside it or its labels/membership go stale.\n    const expanded = options?.collections ? (this.pairExpander?.(options.collections) ?? options.collections) : null\n    const filter = expanded ? new Set([...expanded, ...(this.reservedDictExpander?.(expanded) ?? [])]) : null\n\n    try {\n      const remoteSnapshot = await this.remote.loadAll(this.vault)\n\n      for (const [collName, records] of Object.entries(remoteSnapshot)) {\n        // Partial sync: skip collections not in the filter\n        if (filter && !filter.has(collName)) {\n          continue\n        }\n\n        for (const [id, remoteEnvelope] of Object.entries(records)) {\n          // Partial sync: modifiedSince filter — arriving tombstones are exempt (#590):\n          // an erasure must never be skipped by partial sync.\n          if (\n            options?.modifiedSince &&\n            remoteEnvelope._ts <= options.modifiedSince &&\n            !isTombstoneShape(remoteEnvelope) &&\n            !isDeleteMarker(remoteEnvelope)\n          ) {\n            continue\n          }\n\n          // #807: period scope — a record whose `_ts` falls outside every selected\n          // window is skipped. Tombstones and delete markers are ALWAYS in scope\n          // (built into the predicate): an erasure or delete must never be skipped\n          // by partial sync, mirroring the modifiedSince exemption above — that is\n          // what lets a device that never pulled a period backfill it later without\n          // resurrecting its deleted records.\n          if (periodScope !== null && !periodScope(remoteEnvelope)) {\n            continue\n          }\n\n          try {\n            const localEnvelope = await this.local.get(this.vault, collName, id)\n            const remoteIsTombstone = isTombstoneShape(remoteEnvelope)\n\n            if (!localEnvelope) {\n              // New record from remote (tombstones included — durable erasure evidence)\n              await this.applyRemote(collName, id, remoteEnvelope)\n              pulled++\n            } else if (isTombstoneShape(localEnvelope)) {\n              if (remoteIsTombstone) {\n                // Both shredded — keep the higher version counter\n                if (remoteEnvelope._v > localEnvelope._v) await this.applyRemote(collName, id, remoteEnvelope)\n              } else {\n                // Terminal rule (#590): a tombstone is never overwritten by a live\n                // envelope, regardless of _v. Re-assert the shred outward instead.\n                erasures.push(await this.reassertTombstone(collName, id, localEnvelope, remoteEnvelope))\n              }\n            } else if (remoteIsTombstone) {\n              // Terminal rule (#590): an arriving tombstone wins over any local live\n              // envelope — even a newer, dirty one. Resolvers are never consulted.\n              const wasDirty = this.dirty.some(d => d.collection === collName && d.id === id)\n              await this.applyRemote(collName, id, remoteEnvelope)\n              this.dirty = this.dirty.filter(d => !(d.collection === collName && d.id === id))\n              pulled++\n              if (wasDirty) erasures.push(this.reportErasure(collName, id, remoteEnvelope, localEnvelope, 'pull'))\n            } else if (\n              remoteEnvelope._v === localEnvelope._v &&\n              isDeleteMarker(remoteEnvelope) !== isDeleteMarker(localEnvelope)\n            ) {\n              // #589: true concurrent delete-vs-edit at the SAME version. Version order\n              // can't break the tie. A per-collection resolver decides if one is set;\n              // otherwise DELETE wins (the db-level 'version' default is deliberately NOT\n              // consulted — it would resolve a tie to local-wins).\n              const resolver = this.conflictResolvers.get(collName)\n              if (resolver) {\n                const winner = await resolver(id, localEnvelope, remoteEnvelope)\n                if (winner !== localEnvelope && winner !== null) {\n                  // #589 (review): a novel/merged winner (neither side verbatim) must also be\n                  // pushed to remote — mirrors handleConflict's 'merged' handling — so both\n                  // sides converge instead of local applying it while remote keeps its old copy.\n                  if (winner !== remoteEnvelope) {\n                    await this.remote.put(this.vault, collName, id, winner)\n                  }\n                  await this.applyRemote(collName, id, winner)\n                  this.dirty = this.dirty.filter(d => !(d.collection === collName && d.id === id))\n                  pulled++\n                }\n                // winner === localEnvelope or null → keep local (its dirty entry, if any, pushes out)\n              } else if (isDeleteMarker(remoteEnvelope)) {\n                // no resolver → delete wins; the incoming marker is the delete\n                await this.applyRemote(collName, id, remoteEnvelope)\n                this.dirty = this.dirty.filter(d => !(d.collection === collName && d.id === id))\n                pulled++\n              }\n              // no resolver and LOCAL is the marker → keep local marker; its dirty 'put' pushes it outward\n            } else if (remoteEnvelope._v > localEnvelope._v) {\n              // Remote is newer — check if we have a dirty entry for this\n              const isDirty = this.dirty.some(d => d.collection === collName && d.id === id)\n              if (isDirty) {\n                // Both changed — conflict\n                const { handled, conflict } = await this.handleConflict(\n                  collName,\n                  id,\n                  localEnvelope,\n                  remoteEnvelope,\n                  'pull',\n                )\n                conflicts.push(conflict)\n                if (handled === 'remote') {\n                  await this.applyRemote(collName, id, conflict.remote)\n                  this.dirty = this.dirty.filter(d => !(d.collection === collName && d.id === id))\n                  pulled++\n                } else if (handled === 'merged' && conflict.local !== localEnvelope) {\n                  const merged = conflict.local\n                  await this.applyRemote(collName, id, merged)\n                  this.dirty = this.dirty.filter(d => !(d.collection === collName && d.id === id))\n                  pulled++\n                }\n                // 'local' or 'deferred': push handles it\n              } else {\n                // Remote is newer, no local changes — update\n                await this.applyRemote(collName, id, remoteEnvelope)\n                pulled++\n              }\n            }\n            // Same version or local is newer — skip (push will handle)\n          } catch (err) {\n            errors.push(err instanceof Error ? err : new Error(String(err)))\n          }\n        }\n      }\n\n      // #650 Task 4 (#647) — reserved lookup collections (`_dict_*`/`_lookup_*`) are invisible to\n      // `remote.loadAll()` above (the store contract skips `_`-prefixed names) but DO sync via\n      // this EXPLICIT, declared registry — not a blanket underscore-glob; other `_` namespaces\n      // keep their `loadAll`-skip semantics untouched. Applied through the SAME `applyRemote` path,\n      // still inside this try block, BEFORE `persistMeta`/`flush` below — so a pulled vocabulary\n      // row lands before the wave (flushed at the end of `pull()`) recomputes any dependent.\n      //\n      // #647 fix wave 1: `LookupHandle.delete()`/`rename()` now write a version-ordered\n      // delete-marker row (mirroring #589) instead of a raw adapter delete, so a removed key is\n      // a normal row here too — reachable via `remote.list()` like any other id, applied by\n      // version like any other write. The only reserved-tier-specific rule is the same-version\n      // tie-break below: reserved lookups have no per-collection conflict-resolver concept\n      // (dictionaries are admin-edited, not multi-actor-negotiated), so a converging delete\n      // unconditionally wins over a same-version live edit.\n      //\n      // #807: the period scope deliberately does NOT apply here — vocabularies/config rows are\n      // not period-partitioned data (a thin client's lookups must be complete regardless of\n      // which periods it pulled), the same always-pull rule as the `_periods` summaries phase.\n      for (const collName of this.reservedLookup?.collections() ?? []) {\n        if (filter && !filter.has(collName)) continue\n        for (const id of await this.remote.list(this.vault, collName)) {\n          try {\n            const remoteEnvelope = await this.remote.get(this.vault, collName, id)\n            if (!remoteEnvelope) continue\n\n            // Partial sync: modifiedSince filter — a delete marker is exempt, mirroring the\n            // main loop's tombstone/marker exemption above: a deletion must never be silently\n            // skipped by a time-window partial pull.\n            if (\n              options?.modifiedSince &&\n              remoteEnvelope._ts <= options.modifiedSince &&\n              !isDeleteMarker(remoteEnvelope)\n            ) {\n              continue\n            }\n\n            const localEnvelope = await this.local.get(this.vault, collName, id)\n            if (!localEnvelope) {\n              await this.applyRemote(collName, id, remoteEnvelope)\n              pulled++\n            } else if (\n              remoteEnvelope._v === localEnvelope._v &&\n              isDeleteMarker(remoteEnvelope) !== isDeleteMarker(localEnvelope)\n            ) {\n              // Same-version delete-vs-edit tie (#589's rule, reserved-tier default: no\n              // resolver concept here, so delete always wins).\n              if (isDeleteMarker(remoteEnvelope)) {\n                await this.applyRemote(collName, id, remoteEnvelope)\n                this.dirty = this.dirty.filter(d => !(d.collection === collName && d.id === id))\n                pulled++\n              }\n              // else: local already holds the marker (a local delete not yet observed\n              // remotely) — keep it; push re-asserts it.\n            } else if (remoteEnvelope._v > localEnvelope._v) {\n              await this.applyRemote(collName, id, remoteEnvelope)\n              // Drop any now-superseded local dirty entry so a subsequent push doesn't\n              // redundantly re-fight a CAS conflict over content pull just overwrote.\n              this.dirty = this.dirty.filter(d => !(d.collection === collName && d.id === id))\n              pulled++\n            }\n          } catch (err) {\n            errors.push(err instanceof Error ? err : new Error(String(err)))\n          }\n        }\n      }\n    } catch (err) {\n      errors.push(err instanceof Error ? err : new Error(String(err)))\n    }\n\n    this.lastPull = new Date().toISOString()\n    try {\n      await this.persistMeta()\n    } finally {\n      this.pullByteSink = null // #807: stop attributing applies to this pull's KPI counters\n      // #644 item 1: flush must run even if `persistMeta()` throws (see push()'s identical guard).\n      await this.graphBatchController?.flush() // #638 Task 4\n    }\n\n    const result: PullResult = { pulled, conflicts, errors, erasures, ...(phases !== null ? { phases } : {}) }\n    this.emitter.emit('sync:pull', result)\n    return result\n  }\n\n  /** Bidirectional sync: pull then push. */\n  async sync(options?: { push?: PushOptions; pull?: PullOptions }): Promise<{ pull: PullResult; push: PushResult }> {\n    const pullResult = await this.pull(options?.pull)\n    const pushResult = await this.push(options?.push)\n    return { pull: pullResult, push: pushResult }\n  }\n\n  /**\n   * Push a specific subset of dirty entries (for sync transactions, ).\n   * Entries are matched by collection+id from the dirty log; matched entries\n   * are removed from the dirty log on success.\n   */\n  async pushFiltered(predicate: (entry: DirtyEntry) => boolean): Promise<PushResult> {\n    await this.ensureLoaded()\n\n    let pushed = 0\n    const conflicts: Conflict[] = []\n    const erasures: ErasureEnforcement[] = []\n    const errors: Error[] = []\n    const completed: number[] = []\n\n    for (let i = 0; i < this.dirty.length; i++) {\n      const entry = this.dirty[i]!\n      if (!predicate(entry)) continue\n\n      try {\n        if (entry.action === 'delete') {\n          await this.remote.delete(this.vault, entry.collection, entry.id)\n          completed.push(i)\n          pushed++\n        } else {\n          const envelope = await this.local.get(this.vault, entry.collection, entry.id)\n          if (!envelope) {\n            completed.push(i)\n            continue\n          }\n\n          if (isTombstoneShape(envelope)) {\n            // #590: a tombstone push is an erasure assertion — unconditional,\n            // no CAS, no conflict resolution. Erasure always wins.\n            await this.remote.put(this.vault, entry.collection, entry.id, envelope)\n            completed.push(i)\n            pushed++\n            continue\n          }\n\n          try {\n            await this.remote.put(\n              this.vault,\n              entry.collection,\n              entry.id,\n              envelope,\n              entry.version - 1,\n            )\n            completed.push(i)\n            pushed++\n          } catch (err) {\n            if (isConflictError(err)) {\n              const remoteEnvelope = await this.remote.get(this.vault, entry.collection, entry.id)\n              if (remoteEnvelope) {\n                if (isTombstoneShape(remoteEnvelope)) {\n                  // #590: remote already shredded this record — enforce locally,\n                  // never resolve. Resolvers must not overrule an erasure.\n                  await this.applyRemote(entry.collection, entry.id, remoteEnvelope)\n                  erasures.push(this.reportErasure(entry.collection, entry.id, remoteEnvelope, envelope, 'push'))\n                  completed.push(i)\n                } else if (\n                  remoteEnvelope._v === envelope._v &&\n                  isDeleteMarker(remoteEnvelope) !== isDeleteMarker(envelope) &&\n                  !this.conflictResolvers.get(entry.collection)\n                ) {\n                  // #589: a same-_v delete-vs-edit tie on the push channel. handleConflict's db-level\n                  // 'version' default would resolve it to local-wins; the tie rule consults ONLY the\n                  // per-collection resolver, else delete-wins. (When a per-collection resolver IS set,\n                  // fall through to handleConflict, which already honors it — incl. the merged case.)\n                  if (isDeleteMarker(remoteEnvelope)) {\n                    // remote already deleted → converge locally, drop our (edit) push\n                    await this.applyRemote(entry.collection, entry.id, remoteEnvelope)\n                    completed.push(i)\n                  } else {\n                    // our local is the marker → force the delete onto the remote (unconditional put)\n                    await this.remote.put(this.vault, entry.collection, entry.id, envelope)\n                    completed.push(i)\n                    pushed++\n                  }\n                } else {\n                  const { handled, conflict } = await this.handleConflict(\n                    entry.collection,\n                    entry.id,\n                    envelope,\n                    remoteEnvelope,\n                    'push',\n                  )\n                  conflicts.push(conflict)\n                  if (handled === 'local') {\n                    // #936: supersede, don't overwrite in place — see advancePastRemote.\n                    const winner = this.advancePastRemote(conflict.local, remoteEnvelope)\n                    await this.remote.put(this.vault, entry.collection, entry.id, winner)\n                    if (winner !== conflict.local) await this.applyRemote(entry.collection, entry.id, winner)\n                    completed.push(i)\n                    pushed++\n                  } else if (handled === 'remote') {\n                    await this.applyRemote(entry.collection, entry.id, conflict.remote)\n                    completed.push(i)\n                  } else if (handled === 'merged' && conflict.local !== envelope) {\n                    const merged = conflict.local\n                    await this.remote.put(this.vault, entry.collection, entry.id, merged)\n                    await this.applyRemote(entry.collection, entry.id, merged)\n                    completed.push(i)\n                    pushed++\n                  }\n                }\n              }\n            } else {\n              throw err\n            }\n          }\n        }\n      } catch (err) {\n        errors.push(err instanceof Error ? err : new Error(String(err)))\n      }\n    }\n\n    for (const i of completed.sort((a, b) => b - a)) {\n      this.dirty.splice(i, 1)\n    }\n\n    this.lastPush = new Date().toISOString()\n    await this.persistMeta()\n\n    const result: PushResult = { pushed, conflicts, errors, erasures }\n    this.emitter.emit('sync:push', result)\n    return result\n  }\n\n  /** Get current sync status. */\n  status(): SyncStatus {\n    // #809 — readiness rides the status surface that already exists rather than\n    // a second accessor, so an app asks one question to learn everything about\n    // this vault's sync. Absent entirely unless a phased policy is running.\n    const scheduled = this.scheduler?.status\n    return {\n      dirty: this.dirty.length,\n      lastPush: this.lastPush,\n      lastPull: this.lastPull,\n      online: this.isOnline,\n      ...(scheduled && scheduled.readiness.size > 0\n        ? { readiness: scheduled.readiness, phase: scheduled.phase }\n        : {}),\n    }\n  }\n\n  // ─── Auto-Sync ───────────────────────────────────────────────────\n\n  /** Start auto-sync: listen for online/offline events, optional periodic sync. */\n  startAutoSync(intervalMs?: number): void {\n    // Online/offline detection\n    if (typeof globalThis.addEventListener === 'function') {\n      globalThis.addEventListener('online', this.handleOnline)\n      globalThis.addEventListener('offline', this.handleOffline)\n    }\n\n    // Periodic sync\n    if (intervalMs && intervalMs > 0) {\n      this.autoSyncInterval = setInterval(() => {\n        if (this.isOnline) {\n          void this.sync()\n        }\n      }, intervalMs)\n    }\n  }\n\n  /** Stop auto-sync and scheduler. */\n  stopAutoSync(): void {\n    this.stopScheduler()\n    if (typeof globalThis.removeEventListener === 'function') {\n      globalThis.removeEventListener('online', this.handleOnline)\n      globalThis.removeEventListener('offline', this.handleOffline)\n    }\n    if (this.autoSyncInterval) {\n      clearInterval(this.autoSyncInterval)\n      this.autoSyncInterval = null\n    }\n  }\n\n  private handleOnline = (): void => {\n    this.isOnline = true\n    this.emitter.emit('sync:online', undefined as never)\n    void this.sync()\n  }\n\n  private handleOffline = (): void => {\n    this.isOnline = false\n    this.emitter.emit('sync:offline', undefined as never)\n  }\n\n  /** Apply an envelope to the local store and refresh in-memory views (#598). `action` (#640):\n   *  classified HERE — the one choke point that still holds the envelope — so the\n   *  cacheInvalidator seam (and, downstream, the dispatch wave) can tell a pulled delete from an\n   *  ordinary put. `isTombstoneShape` covers a forgotten-elsewhere record arriving as a shred;\n   *  `isDeleteMarker` covers an ordinary (#589) delete — both route to the SAME 'delete' action\n   *  (sync delete ≠ forget: freshness only, no shred/residue channel on the receiving side). */\n  /**\n   * #936 — a local-wins resolution write must SUPERSEDE the remote, never\n   * overwrite it in place: when the winner's `_v` does not already exceed\n   * the remote's (the same-`_v` push tie), re-stamp it at `remote._v + 1`.\n   * Without this the loser's next pull sees no delta (`_v`-based\n   * detection) and the peers stay silently diverged at the same version.\n   * `_v` is envelope metadata — AEAD-unbound, and `_vdig` is deliberately\n   * `_v`-independent — so the engine may restamp ciphertext. Callers must\n   * mirror the advanced envelope locally (`applyRemote`) so both sides\n   * agree. The 'merged' branch needs none of this: resolver output is\n   * already stamped `max(local, remote) + 1`.\n   */\n  private advancePastRemote(winner: EncryptedEnvelope, remote: EncryptedEnvelope): EncryptedEnvelope {\n    return winner._v > remote._v ? winner : { ...winner, _v: remote._v + 1 }\n  }\n\n  private async applyRemote(collection: string, id: string, envelope: EncryptedEnvelope): Promise<void> {\n    await this.local.put(this.vault, collection, id, envelope)\n    if (this.pullByteSink !== null) {\n      // #807: KPI — one applied envelope; bytes ≈ ciphertext payload size.\n      this.pullByteSink.records++\n      this.pullByteSink.bytes += envelopeBodySize(envelope)\n    }\n    const action: 'put' | 'delete' = isTombstoneShape(envelope) || isDeleteMarker(envelope) ? 'delete' : 'put'\n    await this.cacheInvalidator?.(collection, id, action)\n  }\n\n  /** Record + emit a tombstone enforcement (#590). */\n  private reportErasure(\n    collection: string, id: string,\n    tombstone: EncryptedEnvelope, suppressed: EncryptedEnvelope,\n    direction: 'pull' | 'push',\n  ): ErasureEnforcement {\n    const enforcement: ErasureEnforcement = { vault: this.vault, collection, id, tombstone, suppressed, direction }\n    this.emitter.emit('sync:erasure', enforcement)\n    return enforcement\n  }\n\n  /**\n   * Re-assert a local tombstone over a live remote envelope (#590): the shred\n   * wins in both directions, regardless of `_v`. Bumps the tombstone to the\n   * suppressed envelope's `_v` when higher so per-key version counters stay\n   * monotonic on every store; `_by` (the shredding actor) is preserved.\n   */\n  private async reassertTombstone(\n    collection: string, id: string,\n    tombstone: EncryptedEnvelope, suppressedRemote: EncryptedEnvelope,\n  ): Promise<ErasureEnforcement> {\n    let winner = tombstone\n    if (suppressedRemote._v > tombstone._v) {\n      winner = { ...tombstone, _v: suppressedRemote._v, _ts: new Date().toISOString() }\n      await this.applyRemote(collection, id, winner)\n    }\n    await this.remote.put(this.vault, collection, id, winner)\n    // The re-assert already delivered the tombstone remotely — drop any dirty\n    // entry so the following push doesn't redundantly re-put it.\n    this.dirty = this.dirty.filter(d => !(d.collection === collection && d.id === id))\n    return this.reportErasure(collection, id, winner, suppressedRemote, 'pull')\n  }\n\n  /**\n   * Resolve a conflict, checking per-collection resolvers first,\n   * then falling back to the db-level `ConflictStrategy`.\n   *\n   * Returns the resolved `Conflict` object (possibly with `resolve` set for\n   * manual mode) and a `handled` discriminant:\n   * - `'local'` — keep the local envelope; push it to remote.\n   * - `'remote'` — keep the remote envelope; update local.\n   * - `'merged'` — a custom merge fn produced a new envelope stored as `conflict.local`.\n   * - `'deferred'` — manual mode, resolve was not called synchronously.\n   */\n  private async handleConflict(\n    collection: string,\n    id: string,\n    local: EncryptedEnvelope,\n    remote: EncryptedEnvelope,\n    _phase: 'push' | 'pull',\n  ): Promise<{ handled: 'local' | 'remote' | 'merged' | 'deferred'; conflict: Conflict }> {\n    const resolver = this.conflictResolvers.get(collection)\n\n    if (resolver) {\n      // Per-collection resolver is responsible for emitting sync:conflict\n      // (manual policy emits with a resolve callback; LWW/FWW/custom are silent).\n      const winner = await resolver(id, local, remote)\n      const base: Conflict = {\n        vault: this.vault,\n        collection,\n        id,\n        local,\n        remote,\n        localVersion: local._v,\n        remoteVersion: remote._v,\n      }\n      if (winner === null) return { handled: 'deferred', conflict: base }\n      if (winner === local) return { handled: 'local', conflict: base }\n      if (winner === remote) return { handled: 'remote', conflict: base }\n      // Custom merge fn produced a new envelope — store as conflict.local for the caller\n      return {\n        handled: 'merged',\n        conflict: { ...base, local: winner, localVersion: winner._v },\n      }\n    }\n\n    // Fall back to db-level strategy — emit once\n    const baseConflict: Conflict = {\n      vault: this.vault,\n      collection,\n      id,\n      local,\n      remote,\n      localVersion: local._v,\n      remoteVersion: remote._v,\n    }\n    this.emitter.emit('sync:conflict', baseConflict)\n    const side = this.legacyResolve(baseConflict)\n    return { handled: side, conflict: baseConflict }\n  }\n\n  /** DB-level ConflictStrategy resolution (legacy, kept for backward compat). */\n  private legacyResolve(conflict: Conflict): 'local' | 'remote' {\n    if (typeof this.strategy === 'function') {\n      return this.strategy(conflict)\n    }\n    switch (this.strategy) {\n      case 'local-wins': return 'local'\n      case 'remote-wins': return 'remote'\n      case 'version':\n      default:\n        return conflict.localVersion >= conflict.remoteVersion ? 'local' : 'remote'\n    }\n  }\n\n  // ─── Persistence ─────────────────────────────────────────────────\n\n  private async ensureLoaded(): Promise<void> {\n    if (this.loaded) return\n\n    const envelope = await this.local.get(this.vault, '_sync', 'meta')\n    if (envelope) {\n      const meta = JSON.parse(envelope._data) as SyncMetadata\n      this.dirty = [...meta.dirty]\n      this.lastPush = meta.last_push\n      this.lastPull = meta.last_pull\n    }\n\n    this.loaded = true\n  }\n\n  private async persistMeta(): Promise<void> {\n    const meta: SyncMetadata = {\n      _noydb_sync: NOYDB_SYNC_VERSION,\n      last_push: this.lastPush,\n      last_pull: this.lastPull,\n      dirty: this.dirty,\n    }\n\n    const envelope: EncryptedEnvelope = {\n      _noydb: 1,\n      _v: 1,\n      _ts: new Date().toISOString(),\n      _iv: '',\n      _data: JSON.stringify(meta),\n    }\n\n    await this.local.put(this.vault, '_sync', 'meta', envelope)\n  }\n}\n","import type { SyncTransactionResult } from '../kernel/types.js'\nimport type { SyncEngine } from './engine.js'\nimport type { Vault } from '../kernel/vault.js'\n\ninterface TxOp {\n  readonly type: 'put' | 'delete'\n  readonly collection: string\n  readonly id: string\n  readonly record?: unknown\n}\n\n/**\n * Sync transaction.\n *\n * Stages local writes and then pushes only those records to remote in a\n * single batch. If any record conflicts during the push, the result\n * carries `status: 'conflict'` — no automatic rollback is performed;\n * the caller handles conflict resolution.\n *\n * Obtain via `db.transaction(compartmentName)`.\n */\nexport class SyncTransaction {\n  private readonly comp: Vault\n  private readonly engine: SyncEngine\n  private readonly ops: TxOp[] = []\n\n  /** @internal — constructed by `Noydb.transaction()` */\n  constructor(comp: Vault, engine: SyncEngine) {\n    this.comp = comp\n    this.engine = engine\n  }\n\n  /** Stage a record write. Does not write to any adapter until `commit()`. */\n  put(collection: string, id: string, record: unknown): this {\n    this.ops.push({ type: 'put', collection, id, record })\n    return this\n  }\n\n  /** Stage a record delete. Does not write to any adapter until `commit()`. */\n  delete(collection: string, id: string): this {\n    this.ops.push({ type: 'delete', collection, id })\n    return this\n  }\n\n  /**\n   * Commit the transaction.\n   *\n   * Phase 1 — writes all staged operations to the local adapter via the\n   * collection layer (encryption + dirty-log tracking).\n   *\n   * Phase 2 — pushes only the records that were written in this\n   * transaction to the remote adapter. Existing dirty entries from\n   * outside this transaction are not affected.\n   *\n   * If any record conflicts during the push, `status` is `'conflict'`\n   * and `conflicts` lists the affected records. No automatic rollback is\n   * performed.\n   */\n  async commit(): Promise<SyncTransactionResult> {\n    // Phase 1: write all staged ops to local via collection layer\n    for (const op of this.ops) {\n      if (op.type === 'put') {\n        // eslint-disable-next-line @typescript-eslint/no-explicit-any\n        await (this.comp.collection<any>(op.collection)).put(op.id, op.record as any)\n      } else {\n        await this.comp.collection(op.collection).delete(op.id)\n      }\n    }\n\n    // Phase 2: push only the records from this transaction\n    const opSet = new Set<string>()\n    for (const op of this.ops) {\n      opSet.add(`${op.collection}::${op.id}`)\n    }\n\n    const pushResult = await this.engine.pushFiltered(\n      (entry) => opSet.has(`${entry.collection}::${entry.id}`),\n    )\n\n    return {\n      status: pushResult.conflicts.length > 0 ? 'conflict' : 'committed',\n      pushed: pushResult.pushed,\n      conflicts: pushResult.conflicts,\n      ...(pushResult.erasures?.length ? { erasures: pushResult.erasures } : {}),\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAoBA,IAAM,SAAS,WAAW,OAAO;AASjC,IAAM,0BAA0B;AAgDzB,IAAM,iBAAN,MAAwB;AAAA,EACZ;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,cAAiC;AAAA,EACjC,iBAAoC;AAAA,EACpC,cAAyD,CAAC;AAAA,EAC1D,oBAAyC;AAAA,EACzC,YAAmD;AAAA,EACnD,UAAU;AAAA,EAElB,YAAY,MAA0B;AACpC,SAAK,UAAU,KAAK;AACpB,SAAK,cAAc,KAAK;AACxB,SAAK,QAAQ,KAAK;AAClB,SAAK,iBAAiB,KAAK;AAC3B,SAAK,SAAS,KAAK;AACnB,SAAK,YAAY,KAAK;AACtB,SAAK,SAAS,KAAK;AACnB,SAAK,UAAU,KAAK,WAAW;AAC/B,SAAK,iBAAiB,KAAK,kBAAkB;AAG7C,SAAK,UAAU,GAAG,KAAK,KAAK,IAAI,KAAK,cAAc;AAEnD,SAAK,oBAAoB,aAAa,KAAK,cAAc;AAAA,EAC3D;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,OAAO,SAA2B;AACtC,QAAI,KAAK,QAAS;AAElB,UAAM,MAAM,MAAM,KAAK,eAAe;AACtC,UAAM,OAAM,oBAAI,KAAK,GAAE,YAAY;AACnC,UAAM,YAAY,KAAK,UAAU,EAAE,QAAQ,KAAK,QAAQ,UAAU,KAAK,QAAQ,CAAC;AAChF,QAAI;AAEJ,QAAI,KAAK,aAAa,KAAK;AACzB,YAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,WAAW,GAAG;AACjD,yBAAmB,KAAK,UAAU,EAAE,IAAI,KAAK,CAAC;AAAA,IAChD,OAAO;AACL,yBAAmB;AAAA,IACrB;AAGA,UAAM,aAAa,KAAK,iBAAiB;AACzC,QAAI,YAAY,iBAAiB;AAC/B,YAAM,WAAW,gBAAgB,KAAK,SAAS,gBAAgB;AAAA,IACjE;AAGA,UAAM,KAAK,mBAAmB,SAAS,GAAG;AAAA,EAC5C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,UAAU,IAAoD;AAC5D,QAAI,KAAK,QAAS,QAAO,MAAM;AAAA,IAAC;AAEhC,SAAK,YAAY,KAAK,EAAE;AAGxB,QAAI,KAAK,YAAY,WAAW,GAAG;AACjC,WAAK,eAAe;AAAA,IACtB;AAEA,WAAO,MAAM;AACX,WAAK,cAAc,KAAK,YAAY,OAAO,OAAK,MAAM,EAAE;AACxD,UAAI,KAAK,YAAY,WAAW,EAAG,MAAK,cAAc;AAAA,IACxD;AAAA,EACF;AAAA;AAAA,EAGA,OAAa;AACX,SAAK,UAAU;AACf,SAAK,cAAc;AACnB,SAAK,cAAc,CAAC;AAAA,EACtB;AAAA;AAAA,EAIA,MAAc,iBAA6C;AACzD,QAAI,CAAC,KAAK,UAAW,QAAO;AAC5B,QAAI,CAAC,KAAK,aAAa;AACrB,UAAI;AACF,cAAM,MAAM,MAAM,KAAK,OAAO,KAAK,cAAc;AACjD,aAAK,cAAc,MAAM,kBAAkB,KAAK,KAAK,cAAc;AAAA,MACrE,QAAQ;AAAA,MAER;AAAA,IACF;AACA,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAc,oBAAgD;AAC5D,QAAI,CAAC,KAAK,UAAW,QAAO;AAC5B,QAAI,CAAC,KAAK,gBAAgB;AACxB,UAAI;AACF,cAAM,MAAM,MAAM,KAAK,OAAO,KAAK,cAAc;AACjD,cAAM,SAAS,MAAM,OAAO,UAAU,OAAO,GAAG;AAChD,cAAM,UAAU,MAAM,OAAO,UAAU,OAAO,QAAQ,QAAQ,OAAO,CAAC,YAAY,CAAC;AACnF,cAAM,OAAO,IAAI,YAAY,EAAE,OAAO,uBAAuB;AAC7D,cAAM,OAAO,IAAI,YAAY,EAAE,OAAO,KAAK,cAAc;AACzD,cAAM,OAAO,MAAM,OAAO,WAAW,EAAE,MAAM,QAAQ,MAAM,WAAW,MAAM,KAAK,GAAG,SAAS,GAAG;AAChG,aAAK,iBAAiB,MAAM,OAAO,UAAU,OAAO,MAAM,EAAE,MAAM,QAAQ,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;AAAA,MAC9G,QAAQ;AAAA,MAER;AAAA,IACF;AACA,WAAO,KAAK;AAAA,EACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAc,YAAY,QAAiC;AACzD,UAAM,SAAS,MAAM,KAAK,kBAAkB;AAC5C,QAAI,CAAC,OAAQ,QAAO;AACpB,UAAM,MAAM,MAAM,OAAO,KAAK,QAAQ,QAAQ,IAAI,YAAY,EAAE,OAAO,MAAM,CAAiB;AAC9F,WAAO,MAAM,KAAK,IAAI,WAAW,GAAG,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAAA,EAC5F;AAAA,EAEQ,mBAA2C;AAEjD,QAAI,KAAK,aAAa,gBAAiB,QAAO,KAAK;AACnD,QAAI,KAAK,QAAQ,gBAAiB,QAAO,KAAK;AAC9C,WAAO;AAAA,EACT;AAAA,EAEQ,iBAAuB;AAC7B,UAAM,aAAa,KAAK,iBAAiB;AAEzC,QAAI,YAAY,mBAAmB;AAEjC,WAAK,oBAAoB,WAAW;AAAA,QAClC,KAAK;AAAA,QACL,CAAC,qBAAqB;AAAE,eAAK,KAAK,oBAAoB,gBAAgB;AAAA,QAAE;AAAA,MAC1E;AAAA,IACF,OAAO;AAEL,WAAK,YAAY;AAAA,QACf,MAAM;AAAE,eAAK,KAAK,oBAAoB;AAAA,QAAE;AAAA,QACxC,KAAK;AAAA,MACP;AAEA,WAAK,KAAK,oBAAoB;AAAA,IAChC;AAAA,EACF;AAAA,EAEQ,gBAAsB;AAC5B,QAAI,KAAK,mBAAmB;AAC1B,WAAK,kBAAkB;AACvB,WAAK,oBAAoB;AAAA,IAC3B;AACA,QAAI,KAAK,WAAW;AAClB,oBAAc,KAAK,SAAS;AAC5B,WAAK,YAAY;AAAA,IACnB;AAAA,EACF;AAAA,EAEA,MAAc,oBAAoB,kBAAyC;AACzE,QAAI;AACF,YAAM,OAAO,MAAM,KAAK,uBAAuB,gBAAgB;AAC/D,UAAI,CAAC,QAAQ,KAAK,WAAW,KAAK,OAAQ;AAE1C,YAAM,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,EAAE,YAAY;AAC/D,UAAI,KAAK,WAAW,OAAQ;AAK5B,YAAM,KAAK,oBAAoB;AAAA,IACjC,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,MAAc,uBACZ,kBACkE;AAClE,UAAM,MAAM,MAAM,KAAK,eAAe;AAEtC,QAAI,CAAC,KAAK,aAAa,CAAC,KAAK;AAC3B,aAAO,KAAK,MAAM,gBAAgB;AAAA,IACpC;AAEA,UAAM,EAAE,IAAI,OAAO,KAAK,IAAI,KAAK,MAAM,gBAAgB;AACvD,UAAM,YAAY,MAAM,QAAQ,OAAO,MAAM,GAAG;AAChD,WAAO,KAAK,MAAM,SAAS;AAAA,EAC7B;AAAA,EAEA,MAAc,mBAAmB,SAAY,KAA4B;AACvE,UAAM,MAAM,MAAM,KAAK,eAAe;AACtC,QAAI,KAAK;AACT,QAAI;AACJ,QAAI;AAEJ,QAAI,KAAK,aAAa,KAAK;AAIzB,YAAM,YAAY,KAAK,UAAU,EAAE,QAAQ,KAAK,QAAQ,QAAQ,CAAC;AACjE,YAAM,SAAS,MAAM,QAAQ,WAAW,GAAG;AAC3C,WAAK,OAAO;AACZ,aAAO,OAAO;AACd,iBAAW,MAAM,KAAK,YAAY,KAAK,MAAM;AAAA,IAC/C,OAAO;AAEL,aAAO,KAAK,UAAU,OAAO;AAC7B,iBAAW,KAAK;AAAA,IAClB;AAEA,UAAM,SAAgC,EAAE,UAAU,KAAK,IAAI,KAAK;AAChE,UAAM,OAAO,KAAK,UAAU,MAAM;AAIlC,UAAM,eAAe,KAAK,eAAe,KAAK;AAC9C,UAAM,WAAW;AAAA,MACf,QAAQ;AAAA,MACR,IAAI;AAAA,MACJ,KAAK;AAAA,MACL,KAAK;AAAA,MACL,OAAO;AAAA,IACT;AACA,QAAI;AACF,YAAM,aAAa;AAAA,QACjB,KAAK;AAAA,QACL,KAAK;AAAA,QACL;AAAA,QACA;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,MAAc,sBAAqC;AACjD,QAAI,KAAK,WAAW,KAAK,YAAY,WAAW,EAAG;AAEnD,QAAI;AACF,YAAM,MAAM,MAAM,KAAK,eAAe;AACtC,YAAM,eAAe,KAAK,eAAe,KAAK;AAC9C,YAAM,MAAM,MAAM,aAAa,KAAK,KAAK,OAAO,KAAK,iBAAiB;AACtE,YAAM,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,EAAE,YAAY;AAC/D,YAAM,QAA2B,CAAC;AAClC,YAAM,QAAQ,MAAM,KAAK,YAAY,KAAK,MAAM;AAEhD,iBAAW,MAAM,KAAK;AACpB,YAAI,OAAO,MAAO;AAClB,cAAM,WAAW,MAAM,aAAa,IAAI,KAAK,OAAO,KAAK,mBAAmB,EAAE;AAC9E,YAAI,CAAC,SAAU;AAEf,YAAI;AACF,gBAAM,SAAS,KAAK,MAAM,SAAS,KAAK;AACxC,cAAI,OAAO,WAAW,OAAQ;AAE9B,cAAI;AACJ,cAAI;AACJ,cAAI,KAAK,aAAa,OAAO,OAAO,IAAI;AACtC,kBAAM,YAAY,MAAM,QAAQ,OAAO,IAAI,OAAO,MAAM,GAAG;AAC3D,kBAAM,UAAU,KAAK,MAAM,SAAS;AACpC,yBAAa,QAAQ;AACrB,0BAAc,QAAQ;AAAA,UACxB,OAAO;AAEL,yBAAa;AACb,0BAAc,KAAK,MAAM,OAAO,IAAI;AAAA,UACtC;AAEA,gBAAM,KAAK,EAAE,QAAQ,YAAY,SAAS,aAAa,UAAU,OAAO,SAAS,CAAC;AAAA,QACpF,QAAQ;AAIN;AAAA,QACF;AAAA,MACF;AAEA,iBAAW,MAAM,KAAK,aAAa;AACjC,WAAG,KAAK;AAAA,MACV;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AACF;;;ACrVO,IAAM,6BAAgD;AAAA,EAC3D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAoBA,IAAM,YACJ;AAGK,SAAS,sBACd,SACmE;AACnE,MAAI,MAAM,QAAQ,OAAO,GAAG;AAC1B,eAAW,KAAK,SAAS;AACvB,UAAI,OAAO,MAAM,YAAY,EAAE,WAAW,EAAG,OAAM,IAAI,gBAAgB,SAAS;AAAA,IAClF;AACA;AAAA,EACF;AACA,MACE,OAAO,YAAY,YAAY,YAAY,QAC1C,QAAkC,YAAY,QAC/C,OAAO,KAAK,OAAO,EAAE,WAAW,GAChC;AACA;AAAA,EACF;AACA,QAAM,IAAI,gBAAgB,SAAS;AACrC;AAWO,SAAS,iBACd,QACA,SAC0C;AAC1C,QAAM,SAAS,QACZ,OAAO,CAAC,MAAM,EAAE,SAAS,QAAQ,EACjC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,OAAO,0BAA0B,EAAE,OAAO,EAAE,EAAE,EAC1E,KAAK,CAAC,GAAG,MAAM,EAAE,MAAM,cAAc,EAAE,KAAK,CAAC;AAEhD,MAAI;AACJ,MAAI,MAAM,QAAQ,MAAM,GAAG;AACzB,cAAW,OAA6B,IAAI,CAAC,SAAS;AACpD,YAAM,MAAM,OAAO,UAAU,CAAC,MAAM,EAAE,SAAS,IAAI;AACnD,UAAI,MAAM,GAAG;AACX,cAAM,QAAQ,QAAQ,KAAK,CAAC,MAAM,EAAE,SAAS,IAAI;AACjD,cAAM,IAAI;AAAA,UACR,QACI,iBAAiB,IAAI,SAAS,MAAM,IAAI,wGACxC,iCAAiC,IAAI;AAAA,QAC3C;AAAA,MACF;AACA,aAAO,EAAE,OAAO,MAAM,IAAI,OAAO,MAAM,CAAC,EAAG,QAAQ,MAAM,OAAO,OAAO,GAAG,EAAG,MAAM;AAAA,IACrF,CAAC;AAAA,EACH,OAAO;AAIL,cAAU,CAAC,EAAE,OAAO,OAAO,SAAS,IAAI,OAAO,OAAO,SAAS,CAAC,EAAG,QAAQ,MAAM,OAAO,KAAK,CAAC;AAAA,EAChG;AAEA,SAAO,CAAC,aAAyC;AAC/C,QAAI,iBAAiB,QAAQ,KAAK,eAAe,QAAQ,EAAG,QAAO;AACnE,WAAO,QAAQ;AAAA,MACb,CAAC,OACE,EAAE,UAAU,QAAQ,SAAS,OAAO,EAAE,WACtC,EAAE,UAAU,QAAQ,SAAS,MAAM,EAAE;AAAA,IAC1C;AAAA,EACF;AACF;;;AC/GO,IAAM,aAAN,MAAiB;AAAA,EACL;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACR;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA,EAED,QAAsB,CAAC;AAAA,EACvB,WAA0B;AAAA,EAC1B,WAA0B;AAAA,EAC1B,SAAS;AAAA,EACT,mBAA0D;AAAA,EAC1D,WAAW;AAAA;AAAA,EAGV;AAAA;AAAA,EAGQ,oBAAoB,oBAAI,IAAwC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASzE;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA;AAAA,EAGR,oBAAoB,IAAuF;AACzG,SAAK,mBAAmB;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA,EAKQ;AAAA;AAAA,EAGR,wBAAwB,YAA6D;AACnF,SAAK,uBAAuB;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA,EAKQ;AAAA;AAAA,EAGR,wBAAwB,QAAoC;AAC1D,SAAK,iBAAiB;AAAA,EACxB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ;AAAA;AAAA,EAGR,wBAAwB,UAAiE;AACvF,SAAK,uBAAuB;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ;AAAA;AAAA,EAGR,oBAAoB,QAAgC;AAClD,SAAK,mBAAmB;AAAA,EAC1B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,eAA0D;AAAA,EAElE,YAAY,MAST;AACD,SAAK,QAAQ,KAAK;AAClB,SAAK,SAAS,KAAK;AACnB,SAAK,QAAQ,KAAK;AAClB,SAAK,WAAW,KAAK;AACrB,SAAK,UAAU,KAAK;AACpB,SAAK,OAAO,KAAK,QAAQ;AACzB,SAAK,QAAQ,KAAK;AAClB,SAAK,SAAS,KAAK;AAMnB,UAAM,SAAS,KAAK;AACpB,QAAI,WAAW,OAAO,KAAK,SAAS,YAAY,OAAO,KAAK,SAAS,WAAW;AAC9E,WAAK,YAAY,IAAI,cAAc,QAAQ;AAAA,QACzC,MAAM,MAAM,KAAK,KAAK,EAAE,KAAK,MAAM;AAAA,QAAC,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAUrC,MAAM,CAAC,gBACL,KAAK,SAAS,cACV,KAAK,KAAK,cAAc,EAAE,aAAa,CAAC,GAAG,WAAW,EAAE,IAAI,MAAS,EAGlE,KAAK,OAAM,EAAE,OAAO,WAAW,IAAI,aAAa,YAAa,IAChE,QAAQ,QAAQ,YAAY;AAAA,QAClC,eAAe,MAAM,KAAK,MAAM;AAAA,MAClC,CAAC;AAAA,IACH,OAAO;AACL,WAAK,YAAY;AAAA,IACnB;AAAA,EACF;AAAA;AAAA,EAGA,iBAAuB;AACrB,SAAK,WAAW,MAAM;AAAA,EACxB;AAAA;AAAA,EAGA,gBAAsB;AACpB,SAAK,WAAW,KAAK;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,yBAAyB,YAAoB,UAA4C;AACvF,eAAW,KAAK,KAAK,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,UAAU,EAAG,MAAK,kBAAkB,IAAI,GAAG,QAAQ;AAAA,EAC3G;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,gBAAgB,UAAiE;AAC/E,SAAK,eAAe;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,sBAAsB,OAAgC;AACpD,UAAM,YAAY,MAAM,IAAI,OAAK,KAAK,kBAAkB,IAAI,CAAC,CAAC,EAAE,KAAK,OAAK,MAAM,MAAS;AACzF,QAAI,CAAC,UAAW;AAChB,eAAW,KAAK,MAAO,MAAK,kBAAkB,IAAI,GAAG,SAAS;AAAA,EAChE;AAAA;AAAA,EAGA,MAAM,YAAY,YAAoB,IAAY,QAA0B,SAAgC;AAC1G,UAAM,KAAK,aAAa;AAGxB,UAAM,MAAM,KAAK,MAAM,UAAU,OAAK,EAAE,eAAe,cAAc,EAAE,OAAO,EAAE;AAChF,UAAM,QAAoB;AAAA,MACxB,OAAO,KAAK;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,IACpC;AAEA,QAAI,OAAO,GAAG;AACZ,WAAK,MAAM,GAAG,IAAI;AAAA,IACpB,OAAO;AACL,WAAK,MAAM,KAAK,KAAK;AAAA,IACvB;AAEA,UAAM,KAAK,YAAY;AAGvB,SAAK,WAAW,aAAa;AAAA,EAC/B;AAAA;AAAA,EAGA,MAAM,YAAY,YAAoB,IAA2B;AAC/D,UAAM,SAAS,KAAK,MAAM;AAC1B,SAAK,QAAQ,KAAK,MAAM,OAAO,OAAK,EAAE,EAAE,eAAe,cAAc,EAAE,OAAO,GAAG;AACjF,QAAI,KAAK,MAAM,WAAW,OAAQ,OAAM,KAAK,YAAY;AAAA,EAC3D;AAAA;AAAA,EAGA,MAAM,KAAK,SAA4C;AACrD,UAAM,KAAK,aAAa;AACxB,SAAK,sBAAsB,MAAM;AAEjC,QAAI,SAAS;AACb,UAAM,YAAwB,CAAC;AAC/B,UAAM,WAAiC,CAAC;AACxC,UAAM,SAAkB,CAAC;AACzB,UAAM,YAAsB,CAAC;AAK7B,UAAM,WAAW,SAAS,cAAe,KAAK,eAAe,QAAQ,WAAW,KAAK,QAAQ,cAAe;AAC5G,UAAM,SAAS,WAAW,oBAAI,IAAI,CAAC,GAAG,UAAU,GAAI,KAAK,uBAAuB,QAAQ,KAAK,CAAC,CAAE,CAAC,IAAI;AAErG,aAAS,IAAI,GAAG,IAAI,KAAK,MAAM,QAAQ,KAAK;AAC1C,YAAM,QAAQ,KAAK,MAAM,CAAC;AAG1B,UAAI,UAAU,CAAC,OAAO,IAAI,MAAM,UAAU,GAAG;AAC3C;AAAA,MACF;AAEA,UAAI;AACF,YAAI,MAAM,WAAW,UAAU;AAC7B,gBAAM,KAAK,OAAO,OAAO,KAAK,OAAO,MAAM,YAAY,MAAM,EAAE;AAC/D,oBAAU,KAAK,CAAC;AAChB;AAAA,QACF,OAAO;AACL,gBAAM,WAAW,MAAM,KAAK,MAAM,IAAI,KAAK,OAAO,MAAM,YAAY,MAAM,EAAE;AAC5E,cAAI,CAAC,UAAU;AAEb,sBAAU,KAAK,CAAC;AAChB;AAAA,UACF;AAEA,cAAI,iBAAiB,QAAQ,GAAG;AAG9B,kBAAM,KAAK,OAAO,IAAI,KAAK,OAAO,MAAM,YAAY,MAAM,IAAI,QAAQ;AACtE,sBAAU,KAAK,CAAC;AAChB;AACA;AAAA,UACF;AAEA,cAAI;AACF,kBAAM,KAAK,OAAO;AAAA,cAChB,KAAK;AAAA,cACL,MAAM;AAAA,cACN,MAAM;AAAA,cACN;AAAA,cACA,MAAM,UAAU;AAAA,YAClB;AACA,sBAAU,KAAK,CAAC;AAChB;AAAA,UACF,SAAS,KAAK;AACZ,gBAAI,gBAAgB,GAAG,GAAG;AACxB,oBAAM,iBAAiB,MAAM,KAAK,OAAO,IAAI,KAAK,OAAO,MAAM,YAAY,MAAM,EAAE;AACnF,kBAAI,gBAAgB;AAClB,oBAAI,iBAAiB,cAAc,GAAG;AAGpC,wBAAM,KAAK,YAAY,MAAM,YAAY,MAAM,IAAI,cAAc;AACjE,2BAAS,KAAK,KAAK,cAAc,MAAM,YAAY,MAAM,IAAI,gBAAgB,UAAU,MAAM,CAAC;AAC9F,4BAAU,KAAK,CAAC;AAAA,gBAClB,WACE,eAAe,OAAO,SAAS,MAC/B,eAAe,cAAc,MAAM,eAAe,QAAQ,KAC1D,CAAC,KAAK,kBAAkB,IAAI,MAAM,UAAU,GAC5C;AAKA,sBAAI,eAAe,cAAc,GAAG;AAElC,0BAAM,KAAK,YAAY,MAAM,YAAY,MAAM,IAAI,cAAc;AACjE,8BAAU,KAAK,CAAC;AAAA,kBAClB,OAAO;AAEL,0BAAM,KAAK,OAAO,IAAI,KAAK,OAAO,MAAM,YAAY,MAAM,IAAI,QAAQ;AACtE,8BAAU,KAAK,CAAC;AAChB;AAAA,kBACF;AAAA,gBACF,OAAO;AACL,wBAAM,EAAE,SAAS,SAAS,IAAI,MAAM,KAAK;AAAA,oBACvC,MAAM;AAAA,oBACN,MAAM;AAAA,oBACN;AAAA,oBACA;AAAA,oBACA;AAAA,kBACF;AACA,4BAAU,KAAK,QAAQ;AACvB,sBAAI,YAAY,SAAS;AAEvB,0BAAM,SAAS,KAAK,kBAAkB,SAAS,OAAO,cAAc;AACpE,0BAAM,KAAK,OAAO,IAAI,KAAK,OAAO,MAAM,YAAY,MAAM,IAAI,MAAM;AACpE,wBAAI,WAAW,SAAS,MAAO,OAAM,KAAK,YAAY,MAAM,YAAY,MAAM,IAAI,MAAM;AACxF,8BAAU,KAAK,CAAC;AAChB;AAAA,kBACF,WAAW,YAAY,UAAU;AAC/B,0BAAM,KAAK,YAAY,MAAM,YAAY,MAAM,IAAI,SAAS,MAAM;AAClE,8BAAU,KAAK,CAAC;AAAA,kBAClB,WAAW,YAAY,YAAY,SAAS,UAAU,UAAU;AAE9D,0BAAM,SAAS,SAAS;AACxB,0BAAM,KAAK,OAAO,IAAI,KAAK,OAAO,MAAM,YAAY,MAAM,IAAI,MAAM;AACpE,0BAAM,KAAK,YAAY,MAAM,YAAY,MAAM,IAAI,MAAM;AACzD,8BAAU,KAAK,CAAC;AAChB;AAAA,kBACF;AAAA,gBAEF;AAAA,cACF;AAAA,YACF,OAAO;AACL,oBAAM;AAAA,YACR;AAAA,UACF;AAAA,QACF;AAAA,MACF,SAAS,KAAK;AACZ,eAAO,KAAK,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC,CAAC;AAAA,MACjE;AAAA,IACF;AAGA,eAAW,KAAK,UAAU,KAAK,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG;AAC/C,WAAK,MAAM,OAAO,GAAG,CAAC;AAAA,IACxB;AAEA,SAAK,YAAW,oBAAI,KAAK,GAAE,YAAY;AACvC,QAAI;AACF,YAAM,KAAK,YAAY;AAAA,IACzB,UAAE;AAIA,YAAM,KAAK,sBAAsB,MAAM;AAAA,IACzC;AAEA,UAAM,SAAqB,EAAE,QAAQ,WAAW,QAAQ,SAAS;AACjE,SAAK,QAAQ,KAAK,aAAa,MAAM;AACrC,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,KAAK,SAA4C;AACrD,UAAM,KAAK,aAAa;AAExB,QAAI,SAAS;AACb,UAAM,YAAwB,CAAC;AAC/B,UAAM,WAAiC,CAAC;AACxC,UAAM,SAAkB,CAAC;AASzB,QAAI,cAAiE;AACrE,QAAI,SAAgH;AACpH,QAAI,SAAS,YAAY,QAAW;AAClC,4BAAsB,QAAQ,OAAO;AACrC,UAAI,CAAC,KAAK,kBAAkB;AAC1B,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,eAAS,EAAE,WAAW,EAAE,SAAS,GAAG,OAAO,EAAE,GAAG,SAAS,EAAE,SAAS,GAAG,OAAO,EAAE,EAAE;AAClF,UAAI,oBAAoB;AACxB,WAAK,eAAe,OAAO;AAC3B,UAAI;AACF,mBAAW,YAAY,4BAA4B;AACjD,qBAAW,MAAM,MAAM,KAAK,OAAO,KAAK,KAAK,OAAO,QAAQ,GAAG;AAC7D,gBAAI,aAAa,mBAAoB;AACrC,gBAAI;AACF,oBAAM,iBAAiB,MAAM,KAAK,OAAO,IAAI,KAAK,OAAO,UAAU,EAAE;AACrE,kBAAI,CAAC,eAAgB;AACrB,oBAAM,gBAAgB,MAAM,KAAK,MAAM,IAAI,KAAK,OAAO,UAAU,EAAE;AACnE,kBAAI,CAAC,iBAAiB,eAAe,KAAK,cAAc,IAAI;AAC1D,sBAAM,KAAK,YAAY,UAAU,IAAI,cAAc;AACnD;AAAA,cACF;AAAA,YACF,SAAS,KAAK;AACZ,qBAAO,KAAK,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC,CAAC;AAAA,YACjE;AAAA,UACF;AAAA,QACF;AAAA,MACF,UAAE;AACA,aAAK,eAAe;AAAA,MACtB;AACA,YAAM,gBAAgB,MAAM,KAAK,iBAAiB,QAAQ;AAC1D,UAAI,oBAAoB,KAAK,cAAc,WAAW,GAAG;AACvD,cAAM,IAAI;AAAA,UACR;AAAA,QAEF;AAAA,MACF;AACA,oBAAc,iBAAiB,QAAQ,SAAS,aAAa;AAAA,IAC/D;AAEA,SAAK,sBAAsB,MAAM;AACjC,QAAI,OAAQ,MAAK,eAAe,OAAO;AAMvC,UAAM,WAAW,SAAS,cAAe,KAAK,eAAe,QAAQ,WAAW,KAAK,QAAQ,cAAe;AAC5G,UAAM,SAAS,WAAW,oBAAI,IAAI,CAAC,GAAG,UAAU,GAAI,KAAK,uBAAuB,QAAQ,KAAK,CAAC,CAAE,CAAC,IAAI;AAErG,QAAI;AACF,YAAM,iBAAiB,MAAM,KAAK,OAAO,QAAQ,KAAK,KAAK;AAE3D,iBAAW,CAAC,UAAU,OAAO,KAAK,OAAO,QAAQ,cAAc,GAAG;AAEhE,YAAI,UAAU,CAAC,OAAO,IAAI,QAAQ,GAAG;AACnC;AAAA,QACF;AAEA,mBAAW,CAAC,IAAI,cAAc,KAAK,OAAO,QAAQ,OAAO,GAAG;AAG1D,cACE,SAAS,iBACT,eAAe,OAAO,QAAQ,iBAC9B,CAAC,iBAAiB,cAAc,KAChC,CAAC,eAAe,cAAc,GAC9B;AACA;AAAA,UACF;AAQA,cAAI,gBAAgB,QAAQ,CAAC,YAAY,cAAc,GAAG;AACxD;AAAA,UACF;AAEA,cAAI;AACF,kBAAM,gBAAgB,MAAM,KAAK,MAAM,IAAI,KAAK,OAAO,UAAU,EAAE;AACnE,kBAAM,oBAAoB,iBAAiB,cAAc;AAEzD,gBAAI,CAAC,eAAe;AAElB,oBAAM,KAAK,YAAY,UAAU,IAAI,cAAc;AACnD;AAAA,YACF,WAAW,iBAAiB,aAAa,GAAG;AAC1C,kBAAI,mBAAmB;AAErB,oBAAI,eAAe,KAAK,cAAc,GAAI,OAAM,KAAK,YAAY,UAAU,IAAI,cAAc;AAAA,cAC/F,OAAO;AAGL,yBAAS,KAAK,MAAM,KAAK,kBAAkB,UAAU,IAAI,eAAe,cAAc,CAAC;AAAA,cACzF;AAAA,YACF,WAAW,mBAAmB;AAG5B,oBAAM,WAAW,KAAK,MAAM,KAAK,OAAK,EAAE,eAAe,YAAY,EAAE,OAAO,EAAE;AAC9E,oBAAM,KAAK,YAAY,UAAU,IAAI,cAAc;AACnD,mBAAK,QAAQ,KAAK,MAAM,OAAO,OAAK,EAAE,EAAE,eAAe,YAAY,EAAE,OAAO,GAAG;AAC/E;AACA,kBAAI,SAAU,UAAS,KAAK,KAAK,cAAc,UAAU,IAAI,gBAAgB,eAAe,MAAM,CAAC;AAAA,YACrG,WACE,eAAe,OAAO,cAAc,MACpC,eAAe,cAAc,MAAM,eAAe,aAAa,GAC/D;AAKA,oBAAM,WAAW,KAAK,kBAAkB,IAAI,QAAQ;AACpD,kBAAI,UAAU;AACZ,sBAAM,SAAS,MAAM,SAAS,IAAI,eAAe,cAAc;AAC/D,oBAAI,WAAW,iBAAiB,WAAW,MAAM;AAI/C,sBAAI,WAAW,gBAAgB;AAC7B,0BAAM,KAAK,OAAO,IAAI,KAAK,OAAO,UAAU,IAAI,MAAM;AAAA,kBACxD;AACA,wBAAM,KAAK,YAAY,UAAU,IAAI,MAAM;AAC3C,uBAAK,QAAQ,KAAK,MAAM,OAAO,OAAK,EAAE,EAAE,eAAe,YAAY,EAAE,OAAO,GAAG;AAC/E;AAAA,gBACF;AAAA,cAEF,WAAW,eAAe,cAAc,GAAG;AAEzC,sBAAM,KAAK,YAAY,UAAU,IAAI,cAAc;AACnD,qBAAK,QAAQ,KAAK,MAAM,OAAO,OAAK,EAAE,EAAE,eAAe,YAAY,EAAE,OAAO,GAAG;AAC/E;AAAA,cACF;AAAA,YAEF,WAAW,eAAe,KAAK,cAAc,IAAI;AAE/C,oBAAM,UAAU,KAAK,MAAM,KAAK,OAAK,EAAE,eAAe,YAAY,EAAE,OAAO,EAAE;AAC7E,kBAAI,SAAS;AAEX,sBAAM,EAAE,SAAS,SAAS,IAAI,MAAM,KAAK;AAAA,kBACvC;AAAA,kBACA;AAAA,kBACA;AAAA,kBACA;AAAA,kBACA;AAAA,gBACF;AACA,0BAAU,KAAK,QAAQ;AACvB,oBAAI,YAAY,UAAU;AACxB,wBAAM,KAAK,YAAY,UAAU,IAAI,SAAS,MAAM;AACpD,uBAAK,QAAQ,KAAK,MAAM,OAAO,OAAK,EAAE,EAAE,eAAe,YAAY,EAAE,OAAO,GAAG;AAC/E;AAAA,gBACF,WAAW,YAAY,YAAY,SAAS,UAAU,eAAe;AACnE,wBAAM,SAAS,SAAS;AACxB,wBAAM,KAAK,YAAY,UAAU,IAAI,MAAM;AAC3C,uBAAK,QAAQ,KAAK,MAAM,OAAO,OAAK,EAAE,EAAE,eAAe,YAAY,EAAE,OAAO,GAAG;AAC/E;AAAA,gBACF;AAAA,cAEF,OAAO;AAEL,sBAAM,KAAK,YAAY,UAAU,IAAI,cAAc;AACnD;AAAA,cACF;AAAA,YACF;AAAA,UAEF,SAAS,KAAK;AACZ,mBAAO,KAAK,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC,CAAC;AAAA,UACjE;AAAA,QACF;AAAA,MACF;AAoBA,iBAAW,YAAY,KAAK,gBAAgB,YAAY,KAAK,CAAC,GAAG;AAC/D,YAAI,UAAU,CAAC,OAAO,IAAI,QAAQ,EAAG;AACrC,mBAAW,MAAM,MAAM,KAAK,OAAO,KAAK,KAAK,OAAO,QAAQ,GAAG;AAC7D,cAAI;AACF,kBAAM,iBAAiB,MAAM,KAAK,OAAO,IAAI,KAAK,OAAO,UAAU,EAAE;AACrE,gBAAI,CAAC,eAAgB;AAKrB,gBACE,SAAS,iBACT,eAAe,OAAO,QAAQ,iBAC9B,CAAC,eAAe,cAAc,GAC9B;AACA;AAAA,YACF;AAEA,kBAAM,gBAAgB,MAAM,KAAK,MAAM,IAAI,KAAK,OAAO,UAAU,EAAE;AACnE,gBAAI,CAAC,eAAe;AAClB,oBAAM,KAAK,YAAY,UAAU,IAAI,cAAc;AACnD;AAAA,YACF,WACE,eAAe,OAAO,cAAc,MACpC,eAAe,cAAc,MAAM,eAAe,aAAa,GAC/D;AAGA,kBAAI,eAAe,cAAc,GAAG;AAClC,sBAAM,KAAK,YAAY,UAAU,IAAI,cAAc;AACnD,qBAAK,QAAQ,KAAK,MAAM,OAAO,OAAK,EAAE,EAAE,eAAe,YAAY,EAAE,OAAO,GAAG;AAC/E;AAAA,cACF;AAAA,YAGF,WAAW,eAAe,KAAK,cAAc,IAAI;AAC/C,oBAAM,KAAK,YAAY,UAAU,IAAI,cAAc;AAGnD,mBAAK,QAAQ,KAAK,MAAM,OAAO,OAAK,EAAE,EAAE,eAAe,YAAY,EAAE,OAAO,GAAG;AAC/E;AAAA,YACF;AAAA,UACF,SAAS,KAAK;AACZ,mBAAO,KAAK,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC,CAAC;AAAA,UACjE;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,KAAK;AACZ,aAAO,KAAK,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC,CAAC;AAAA,IACjE;AAEA,SAAK,YAAW,oBAAI,KAAK,GAAE,YAAY;AACvC,QAAI;AACF,YAAM,KAAK,YAAY;AAAA,IACzB,UAAE;AACA,WAAK,eAAe;AAEpB,YAAM,KAAK,sBAAsB,MAAM;AAAA,IACzC;AAEA,UAAM,SAAqB,EAAE,QAAQ,WAAW,QAAQ,UAAU,GAAI,WAAW,OAAO,EAAE,OAAO,IAAI,CAAC,EAAG;AACzG,SAAK,QAAQ,KAAK,aAAa,MAAM;AACrC,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,KAAK,SAAuG;AAChH,UAAM,aAAa,MAAM,KAAK,KAAK,SAAS,IAAI;AAChD,UAAM,aAAa,MAAM,KAAK,KAAK,SAAS,IAAI;AAChD,WAAO,EAAE,MAAM,YAAY,MAAM,WAAW;AAAA,EAC9C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,aAAa,WAAgE;AACjF,UAAM,KAAK,aAAa;AAExB,QAAI,SAAS;AACb,UAAM,YAAwB,CAAC;AAC/B,UAAM,WAAiC,CAAC;AACxC,UAAM,SAAkB,CAAC;AACzB,UAAM,YAAsB,CAAC;AAE7B,aAAS,IAAI,GAAG,IAAI,KAAK,MAAM,QAAQ,KAAK;AAC1C,YAAM,QAAQ,KAAK,MAAM,CAAC;AAC1B,UAAI,CAAC,UAAU,KAAK,EAAG;AAEvB,UAAI;AACF,YAAI,MAAM,WAAW,UAAU;AAC7B,gBAAM,KAAK,OAAO,OAAO,KAAK,OAAO,MAAM,YAAY,MAAM,EAAE;AAC/D,oBAAU,KAAK,CAAC;AAChB;AAAA,QACF,OAAO;AACL,gBAAM,WAAW,MAAM,KAAK,MAAM,IAAI,KAAK,OAAO,MAAM,YAAY,MAAM,EAAE;AAC5E,cAAI,CAAC,UAAU;AACb,sBAAU,KAAK,CAAC;AAChB;AAAA,UACF;AAEA,cAAI,iBAAiB,QAAQ,GAAG;AAG9B,kBAAM,KAAK,OAAO,IAAI,KAAK,OAAO,MAAM,YAAY,MAAM,IAAI,QAAQ;AACtE,sBAAU,KAAK,CAAC;AAChB;AACA;AAAA,UACF;AAEA,cAAI;AACF,kBAAM,KAAK,OAAO;AAAA,cAChB,KAAK;AAAA,cACL,MAAM;AAAA,cACN,MAAM;AAAA,cACN;AAAA,cACA,MAAM,UAAU;AAAA,YAClB;AACA,sBAAU,KAAK,CAAC;AAChB;AAAA,UACF,SAAS,KAAK;AACZ,gBAAI,gBAAgB,GAAG,GAAG;AACxB,oBAAM,iBAAiB,MAAM,KAAK,OAAO,IAAI,KAAK,OAAO,MAAM,YAAY,MAAM,EAAE;AACnF,kBAAI,gBAAgB;AAClB,oBAAI,iBAAiB,cAAc,GAAG;AAGpC,wBAAM,KAAK,YAAY,MAAM,YAAY,MAAM,IAAI,cAAc;AACjE,2BAAS,KAAK,KAAK,cAAc,MAAM,YAAY,MAAM,IAAI,gBAAgB,UAAU,MAAM,CAAC;AAC9F,4BAAU,KAAK,CAAC;AAAA,gBAClB,WACE,eAAe,OAAO,SAAS,MAC/B,eAAe,cAAc,MAAM,eAAe,QAAQ,KAC1D,CAAC,KAAK,kBAAkB,IAAI,MAAM,UAAU,GAC5C;AAKA,sBAAI,eAAe,cAAc,GAAG;AAElC,0BAAM,KAAK,YAAY,MAAM,YAAY,MAAM,IAAI,cAAc;AACjE,8BAAU,KAAK,CAAC;AAAA,kBAClB,OAAO;AAEL,0BAAM,KAAK,OAAO,IAAI,KAAK,OAAO,MAAM,YAAY,MAAM,IAAI,QAAQ;AACtE,8BAAU,KAAK,CAAC;AAChB;AAAA,kBACF;AAAA,gBACF,OAAO;AACL,wBAAM,EAAE,SAAS,SAAS,IAAI,MAAM,KAAK;AAAA,oBACvC,MAAM;AAAA,oBACN,MAAM;AAAA,oBACN;AAAA,oBACA;AAAA,oBACA;AAAA,kBACF;AACA,4BAAU,KAAK,QAAQ;AACvB,sBAAI,YAAY,SAAS;AAEvB,0BAAM,SAAS,KAAK,kBAAkB,SAAS,OAAO,cAAc;AACpE,0BAAM,KAAK,OAAO,IAAI,KAAK,OAAO,MAAM,YAAY,MAAM,IAAI,MAAM;AACpE,wBAAI,WAAW,SAAS,MAAO,OAAM,KAAK,YAAY,MAAM,YAAY,MAAM,IAAI,MAAM;AACxF,8BAAU,KAAK,CAAC;AAChB;AAAA,kBACF,WAAW,YAAY,UAAU;AAC/B,0BAAM,KAAK,YAAY,MAAM,YAAY,MAAM,IAAI,SAAS,MAAM;AAClE,8BAAU,KAAK,CAAC;AAAA,kBAClB,WAAW,YAAY,YAAY,SAAS,UAAU,UAAU;AAC9D,0BAAM,SAAS,SAAS;AACxB,0BAAM,KAAK,OAAO,IAAI,KAAK,OAAO,MAAM,YAAY,MAAM,IAAI,MAAM;AACpE,0BAAM,KAAK,YAAY,MAAM,YAAY,MAAM,IAAI,MAAM;AACzD,8BAAU,KAAK,CAAC;AAChB;AAAA,kBACF;AAAA,gBACF;AAAA,cACF;AAAA,YACF,OAAO;AACL,oBAAM;AAAA,YACR;AAAA,UACF;AAAA,QACF;AAAA,MACF,SAAS,KAAK;AACZ,eAAO,KAAK,eAAe,QAAQ,MAAM,IAAI,MAAM,OAAO,GAAG,CAAC,CAAC;AAAA,MACjE;AAAA,IACF;AAEA,eAAW,KAAK,UAAU,KAAK,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG;AAC/C,WAAK,MAAM,OAAO,GAAG,CAAC;AAAA,IACxB;AAEA,SAAK,YAAW,oBAAI,KAAK,GAAE,YAAY;AACvC,UAAM,KAAK,YAAY;AAEvB,UAAM,SAAqB,EAAE,QAAQ,WAAW,QAAQ,SAAS;AACjE,SAAK,QAAQ,KAAK,aAAa,MAAM;AACrC,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,SAAqB;AAInB,UAAM,YAAY,KAAK,WAAW;AAClC,WAAO;AAAA,MACL,OAAO,KAAK,MAAM;AAAA,MAClB,UAAU,KAAK;AAAA,MACf,UAAU,KAAK;AAAA,MACf,QAAQ,KAAK;AAAA,MACb,GAAI,aAAa,UAAU,UAAU,OAAO,IACxC,EAAE,WAAW,UAAU,WAAW,OAAO,UAAU,MAAM,IACzD,CAAC;AAAA,IACP;AAAA,EACF;AAAA;AAAA;AAAA,EAKA,cAAc,YAA2B;AAEvC,QAAI,OAAO,WAAW,qBAAqB,YAAY;AACrD,iBAAW,iBAAiB,UAAU,KAAK,YAAY;AACvD,iBAAW,iBAAiB,WAAW,KAAK,aAAa;AAAA,IAC3D;AAGA,QAAI,cAAc,aAAa,GAAG;AAChC,WAAK,mBAAmB,YAAY,MAAM;AACxC,YAAI,KAAK,UAAU;AACjB,eAAK,KAAK,KAAK;AAAA,QACjB;AAAA,MACF,GAAG,UAAU;AAAA,IACf;AAAA,EACF;AAAA;AAAA,EAGA,eAAqB;AACnB,SAAK,cAAc;AACnB,QAAI,OAAO,WAAW,wBAAwB,YAAY;AACxD,iBAAW,oBAAoB,UAAU,KAAK,YAAY;AAC1D,iBAAW,oBAAoB,WAAW,KAAK,aAAa;AAAA,IAC9D;AACA,QAAI,KAAK,kBAAkB;AACzB,oBAAc,KAAK,gBAAgB;AACnC,WAAK,mBAAmB;AAAA,IAC1B;AAAA,EACF;AAAA,EAEQ,eAAe,MAAY;AACjC,SAAK,WAAW;AAChB,SAAK,QAAQ,KAAK,eAAe,MAAkB;AACnD,SAAK,KAAK,KAAK;AAAA,EACjB;AAAA,EAEQ,gBAAgB,MAAY;AAClC,SAAK,WAAW;AAChB,SAAK,QAAQ,KAAK,gBAAgB,MAAkB;AAAA,EACtD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoBQ,kBAAkB,QAA2B,QAA8C;AACjG,WAAO,OAAO,KAAK,OAAO,KAAK,SAAS,EAAE,GAAG,QAAQ,IAAI,OAAO,KAAK,EAAE;AAAA,EACzE;AAAA,EAEA,MAAc,YAAY,YAAoB,IAAY,UAA4C;AACpG,UAAM,KAAK,MAAM,IAAI,KAAK,OAAO,YAAY,IAAI,QAAQ;AACzD,QAAI,KAAK,iBAAiB,MAAM;AAE9B,WAAK,aAAa;AAClB,WAAK,aAAa,SAAS,iBAAiB,QAAQ;AAAA,IACtD;AACA,UAAM,SAA2B,iBAAiB,QAAQ,KAAK,eAAe,QAAQ,IAAI,WAAW;AACrG,UAAM,KAAK,mBAAmB,YAAY,IAAI,MAAM;AAAA,EACtD;AAAA;AAAA,EAGQ,cACN,YAAoB,IACpB,WAA8B,YAC9B,WACoB;AACpB,UAAM,cAAkC,EAAE,OAAO,KAAK,OAAO,YAAY,IAAI,WAAW,YAAY,UAAU;AAC9G,SAAK,QAAQ,KAAK,gBAAgB,WAAW;AAC7C,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAc,kBACZ,YAAoB,IACpB,WAA8B,kBACD;AAC7B,QAAI,SAAS;AACb,QAAI,iBAAiB,KAAK,UAAU,IAAI;AACtC,eAAS,EAAE,GAAG,WAAW,IAAI,iBAAiB,IAAI,MAAK,oBAAI,KAAK,GAAE,YAAY,EAAE;AAChF,YAAM,KAAK,YAAY,YAAY,IAAI,MAAM;AAAA,IAC/C;AACA,UAAM,KAAK,OAAO,IAAI,KAAK,OAAO,YAAY,IAAI,MAAM;AAGxD,SAAK,QAAQ,KAAK,MAAM,OAAO,OAAK,EAAE,EAAE,eAAe,cAAc,EAAE,OAAO,GAAG;AACjF,WAAO,KAAK,cAAc,YAAY,IAAI,QAAQ,kBAAkB,MAAM;AAAA,EAC5E;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAaA,MAAc,eACZ,YACA,IACA,OACA,QACA,QACsF;AACtF,UAAM,WAAW,KAAK,kBAAkB,IAAI,UAAU;AAEtD,QAAI,UAAU;AAGZ,YAAM,SAAS,MAAM,SAAS,IAAI,OAAO,MAAM;AAC/C,YAAM,OAAiB;AAAA,QACrB,OAAO,KAAK;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,cAAc,MAAM;AAAA,QACpB,eAAe,OAAO;AAAA,MACxB;AACA,UAAI,WAAW,KAAM,QAAO,EAAE,SAAS,YAAY,UAAU,KAAK;AAClE,UAAI,WAAW,MAAO,QAAO,EAAE,SAAS,SAAS,UAAU,KAAK;AAChE,UAAI,WAAW,OAAQ,QAAO,EAAE,SAAS,UAAU,UAAU,KAAK;AAElE,aAAO;AAAA,QACL,SAAS;AAAA,QACT,UAAU,EAAE,GAAG,MAAM,OAAO,QAAQ,cAAc,OAAO,GAAG;AAAA,MAC9D;AAAA,IACF;AAGA,UAAM,eAAyB;AAAA,MAC7B,OAAO,KAAK;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,cAAc,MAAM;AAAA,MACpB,eAAe,OAAO;AAAA,IACxB;AACA,SAAK,QAAQ,KAAK,iBAAiB,YAAY;AAC/C,UAAM,OAAO,KAAK,cAAc,YAAY;AAC5C,WAAO,EAAE,SAAS,MAAM,UAAU,aAAa;AAAA,EACjD;AAAA;AAAA,EAGQ,cAAc,UAAwC;AAC5D,QAAI,OAAO,KAAK,aAAa,YAAY;AACvC,aAAO,KAAK,SAAS,QAAQ;AAAA,IAC/B;AACA,YAAQ,KAAK,UAAU;AAAA,MACrB,KAAK;AAAc,eAAO;AAAA,MAC1B,KAAK;AAAe,eAAO;AAAA,MAC3B,KAAK;AAAA,MACL;AACE,eAAO,SAAS,gBAAgB,SAAS,gBAAgB,UAAU;AAAA,IACvE;AAAA,EACF;AAAA;AAAA,EAIA,MAAc,eAA8B;AAC1C,QAAI,KAAK,OAAQ;AAEjB,UAAM,WAAW,MAAM,KAAK,MAAM,IAAI,KAAK,OAAO,SAAS,MAAM;AACjE,QAAI,UAAU;AACZ,YAAM,OAAO,KAAK,MAAM,SAAS,KAAK;AACtC,WAAK,QAAQ,CAAC,GAAG,KAAK,KAAK;AAC3B,WAAK,WAAW,KAAK;AACrB,WAAK,WAAW,KAAK;AAAA,IACvB;AAEA,SAAK,SAAS;AAAA,EAChB;AAAA,EAEA,MAAc,cAA6B;AACzC,UAAM,OAAqB;AAAA,MACzB,aAAa;AAAA,MACb,WAAW,KAAK;AAAA,MAChB,WAAW,KAAK;AAAA,MAChB,OAAO,KAAK;AAAA,IACd;AAEA,UAAM,WAA8B;AAAA,MAClC,QAAQ;AAAA,MACR,IAAI;AAAA,MACJ,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,MAC5B,KAAK;AAAA,MACL,OAAO,KAAK,UAAU,IAAI;AAAA,IAC5B;AAEA,UAAM,KAAK,MAAM,IAAI,KAAK,OAAO,SAAS,QAAQ,QAAQ;AAAA,EAC5D;AACF;;;AC3gCO,IAAM,kBAAN,MAAsB;AAAA,EACV;AAAA,EACA;AAAA,EACA,MAAc,CAAC;AAAA;AAAA,EAGhC,YAAY,MAAa,QAAoB;AAC3C,SAAK,OAAO;AACZ,SAAK,SAAS;AAAA,EAChB;AAAA;AAAA,EAGA,IAAI,YAAoB,IAAY,QAAuB;AACzD,SAAK,IAAI,KAAK,EAAE,MAAM,OAAO,YAAY,IAAI,OAAO,CAAC;AACrD,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,OAAO,YAAoB,IAAkB;AAC3C,SAAK,IAAI,KAAK,EAAE,MAAM,UAAU,YAAY,GAAG,CAAC;AAChD,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBA,MAAM,SAAyC;AAE7C,eAAW,MAAM,KAAK,KAAK;AACzB,UAAI,GAAG,SAAS,OAAO;AAErB,cAAO,KAAK,KAAK,WAAgB,GAAG,UAAU,EAAG,IAAI,GAAG,IAAI,GAAG,MAAa;AAAA,MAC9E,OAAO;AACL,cAAM,KAAK,KAAK,WAAW,GAAG,UAAU,EAAE,OAAO,GAAG,EAAE;AAAA,MACxD;AAAA,IACF;AAGA,UAAM,QAAQ,oBAAI,IAAY;AAC9B,eAAW,MAAM,KAAK,KAAK;AACzB,YAAM,IAAI,GAAG,GAAG,UAAU,KAAK,GAAG,EAAE,EAAE;AAAA,IACxC;AAEA,UAAM,aAAa,MAAM,KAAK,OAAO;AAAA,MACnC,CAAC,UAAU,MAAM,IAAI,GAAG,MAAM,UAAU,KAAK,MAAM,EAAE,EAAE;AAAA,IACzD;AAEA,WAAO;AAAA,MACL,QAAQ,WAAW,UAAU,SAAS,IAAI,aAAa;AAAA,MACvD,QAAQ,WAAW;AAAA,MACnB,WAAW,WAAW;AAAA,MACtB,GAAI,WAAW,UAAU,SAAS,EAAE,UAAU,WAAW,SAAS,IAAI,CAAC;AAAA,IACzE;AAAA,EACF;AACF;","names":[]}

package/dist/chunk-BWVKEOPE.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-pod/pod-store.ts","../src/with-pod/redirect.ts","../src/with-pod/open.ts"],"sourcesContent":["import type { NoydbStore, NoydbPodStore, VaultSnapshot, EncryptedEnvelope } from '../kernel/types.js'\nimport { ConflictError, PodVersionConflictError } from '../kernel/errors.js'\n\n// ─── Bundle format ─────────────────────────────────────────────────────\n\nconst BUNDLE_STORE_VERSION = 1 as const\n\n/**\n * Wire format written by `wrapPodStore`. A JSON-serialised object that\n * contains the entire `VaultSnapshot` (all encrypted envelopes) plus a small\n * header for integrity checking. The envelopes inside are already AES-GCM\n * encrypted by core — the bundle bytes themselves are not additionally\n * encrypted, but they are safe to store on untrusted blob hosts because\n * every record inside is already ciphertext.\n *\n * @internal\n */\ninterface BundleStoreData {\n  readonly _noydb_bundle_store: typeof BUNDLE_STORE_VERSION\n  readonly vault: string\n  readonly ts: string\n  readonly data: VaultSnapshot\n}\n\n// ─── Options ───────────────────────────────────────────────────────────\n\nexport interface WrapPodStoreOptions {\n  /**\n   * When `true` (default), every `put()` and `delete()` flushes the full\n   * vault snapshot to the bundle backend. Set to `false` for bulk operations\n   * and call `store.flush(vaultId)` manually.\n   */\n  autoFlush?: boolean\n}\n\n// ─── Extended NoydbStore with flush/batch ───────────────────────────────\n\nexport interface WrappedPodNoydbStore extends NoydbStore {\n  /** Manually flush the in-memory snapshot to the bundle backend. */\n  flush(vaultId: string): Promise<void>\n  /**\n   * Run a batch of mutations without flushing until the callback completes.\n   * A single flush is performed at the end.\n   */\n  batch(vaultId: string, fn: () => Promise<void>): Promise<void>\n}\n\n// ─── wrapPodStore ───────────────────────────────────────────────────\n\nconst MAX_CONFLICT_RETRIES = 3\n\n/**\n * Convert a `NoydbPodStore` (blob-oriented read/write with OCC) into the\n * standard six-method `NoydbStore` interface expected by `createNoydb({ store })`.\n *\n * Bundle stores operate on the entire vault as a single serialised unit —\n * ideal for backends like Google Drive, WebDAV, or iCloud Drive that work\n * best with whole-file I/O rather than per-record KV operations.\n *\n * ## Optimistic concurrency\n *\n * The wrapper tracks the `version` token from the last `readBundle` and\n * passes it as `expectedVersion` on every flush. On\n * `PodVersionConflictError`, it re-reads, merges the remote snapshot\n * (last-write-wins per record key), and retries (max 3 attempts).\n *\n * ## Flush modes\n *\n * By default, flushes on every mutation (O(vault size) per write). Options:\n * - `autoFlush: false` + explicit `store.flush(vaultId)` calls\n * - `store.batch(vaultId, async () => { ... })` — defers flush until end\n * - Pair with `syncPolicy: { push: { mode: 'debounce' } }` from \n */\nexport function wrapPodStore(\n  bundle: NoydbPodStore,\n  options?: WrapPodStoreOptions,\n): WrappedPodNoydbStore {\n  const autoFlush = options?.autoFlush !== false\n\n  // Per-vault state\n  const snapshots = new Map<string, VaultSnapshot>()\n  const versions = new Map<string, string | null>()\n  const loaded = new Set<string>()\n\n  // Batch mode: when > 0, suppress auto-flush\n  let batchDepth = 0\n\n  // #908 — in-flight loads, keyed by vault. Without this, every concurrent\n  // caller issued its own `readBundle` and then REPLACED `snapshots` with a\n  // freshly parsed object — orphaning the mutations earlier callers had\n  // already made to the object they were handed. 100 racing puts kept 1.\n  const loading = new Map<string, Promise<VaultSnapshot>>()\n\n  async function load(vault: string): Promise<VaultSnapshot> {\n    if (loaded.has(vault)) return snapshots.get(vault)!\n\n    const inFlight = loading.get(vault)\n    if (inFlight) return inFlight\n\n    const pending = (async () => {\n      const result = await bundle.readBundle(vault)\n      if (result) {\n        const text = new TextDecoder().decode(result.bytes)\n        const format = JSON.parse(text) as BundleStoreData\n        snapshots.set(vault, format.data)\n        versions.set(vault, result.version)\n      } else {\n        snapshots.set(vault, {})\n        versions.set(vault, null)\n      }\n\n      loaded.add(vault)\n      return snapshots.get(vault)!\n    })()\n\n    loading.set(vault, pending)\n    try {\n      return await pending\n    } finally {\n      // Clear on failure too, so a transient read error does not poison\n      // every later load of this vault with a rejected promise.\n      loading.delete(vault)\n    }\n  }\n\n  async function flush(vault: string): Promise<void> {\n    const snapshot = snapshots.get(vault) ?? {}\n    const format: BundleStoreData = {\n      _noydb_bundle_store: BUNDLE_STORE_VERSION,\n      vault,\n      ts: new Date().toISOString(),\n      data: snapshot,\n    }\n    const bytes = new TextEncoder().encode(JSON.stringify(format))\n    const expectedVersion = versions.get(vault) ?? null\n\n    for (let attempt = 0; attempt < MAX_CONFLICT_RETRIES; attempt++) {\n      try {\n        const { version: newVersion } = await bundle.writeBundle(vault, bytes, expectedVersion)\n        versions.set(vault, newVersion)\n        return\n      } catch (err) {\n        if (err instanceof PodVersionConflictError && attempt < MAX_CONFLICT_RETRIES - 1) {\n          // Pull remote, merge (last-write-wins by record key), retry\n          const remote = await bundle.readBundle(vault)\n          if (remote) {\n            const remoteText = new TextDecoder().decode(remote.bytes)\n            const remoteFormat = JSON.parse(remoteText) as BundleStoreData\n            const localSnap = snapshots.get(vault) ?? {}\n            const mergedSnap = mergeSnapshots(remoteFormat.data, localSnap)\n            snapshots.set(vault, mergedSnap)\n            versions.set(vault, remote.version)\n          }\n          // Re-encode with merged data for the retry\n          continue\n        }\n        throw err\n      }\n    }\n  }\n\n  // #908 — one flush at a time per vault. `flush` reads and writes the vault's\n  // version token, so concurrent flushes race: each sends the same\n  // `expectedVersion`, the losers take the conflict/merge path, and with enough\n  // of them the retry budget is exhausted and the error surfaces to a caller\n  // whose write was perfectly valid. Serialising makes every flush see the\n  // token its predecessor produced.\n  const flushChain = new Map<string, Promise<void>>()\n\n  function serialFlush(vault: string): Promise<void> {\n    const prev = flushChain.get(vault) ?? Promise.resolve()\n    // Chain past a rejection as well — one failed flush must not wedge every\n    // subsequent write to this vault.\n    const next = prev.then(() => flush(vault), () => flush(vault))\n    flushChain.set(vault, next)\n    return next\n  }\n\n  async function maybeFlush(vault: string): Promise<void> {\n    if (autoFlush && batchDepth === 0) {\n      await serialFlush(vault)\n    }\n  }\n\n  const store: WrappedPodNoydbStore = {\n    name: bundle.name ?? 'bundle',\n\n    async flush(vaultId: string): Promise<void> {\n      await serialFlush(vaultId)\n    },\n\n    async batch(vaultId: string, fn: () => Promise<void>): Promise<void> {\n      await load(vaultId) // ensure loaded before batch\n      batchDepth++\n      try {\n        await fn()\n      } finally {\n        batchDepth--\n      }\n      await serialFlush(vaultId)\n    },\n\n    async get(vault: string, collection: string, id: string): Promise<EncryptedEnvelope | null> {\n      const snap = await load(vault)\n      return snap[collection]?.[id] ?? null\n    },\n\n    async put(\n      vault: string,\n      collection: string,\n      id: string,\n      envelope: EncryptedEnvelope,\n      expectedVersion?: number,\n    ): Promise<void> {\n      const snap = await load(vault)\n\n      if (expectedVersion !== undefined) {\n        const current = snap[collection]?.[id]\n        const currentVersion = current?._v ?? 0\n        if (currentVersion !== expectedVersion) {\n          throw new ConflictError(\n            currentVersion,\n            `Expected version ${expectedVersion} but found ${currentVersion} on ${collection}/${id}`,\n          )\n        }\n      }\n\n      snap[collection] ??= {}\n      snap[collection][id] = envelope\n      await maybeFlush(vault)\n    },\n\n    async delete(vault: string, collection: string, id: string): Promise<void> {\n      const snap = await load(vault)\n      if (snap[collection]) {\n        delete snap[collection][id]\n        await maybeFlush(vault)\n      }\n    },\n\n    async list(vault: string, collection: string): Promise<string[]> {\n      const snap = await load(vault)\n      return Object.keys(snap[collection] ?? {})\n    },\n\n    async loadAll(vault: string): Promise<VaultSnapshot> {\n      const snap = await load(vault)\n      // #908 — two contract fixes in one place:\n      //  1. internal collections (`_keyring`, `_sync`) are the vault's own\n      //     bookkeeping and must not appear in a snapshot — `@noy-db/to-file`\n      //     sets the reference behaviour with this same `_`-prefix rule;\n      //  2. copy rather than hand out the live cache, which let a caller\n      //     mutating the result silently rewrite the wrapper's own state.\n      // `get()`/`list()` still serve internal collections; this is about what\n      // a *snapshot* claims, not about hiding data.\n      const out: VaultSnapshot = {}\n      for (const [collection, records] of Object.entries(snap)) {\n        if (collection.startsWith('_')) continue\n        out[collection] = { ...records }\n      }\n      return out\n    },\n\n    async saveAll(vault: string, data: VaultSnapshot): Promise<void> {\n      snapshots.set(vault, data)\n      loaded.add(vault)\n      await serialFlush(vault)\n    },\n  }\n\n  return store\n}\n\n// ─── Snapshot merge (last-write-wins per record) ────────────────────────\n\nfunction mergeSnapshots(remote: VaultSnapshot, local: VaultSnapshot): VaultSnapshot {\n  const merged: VaultSnapshot = {}\n\n  // Start with all remote collections\n  for (const [coll, records] of Object.entries(remote)) {\n    merged[coll] = { ...records }\n  }\n\n  // Overlay local collections — LWW by _ts per record\n  for (const [coll, records] of Object.entries(local)) {\n    if (!merged[coll]) {\n      merged[coll] = { ...records }\n      continue\n    }\n    for (const [id, envelope] of Object.entries(records)) {\n      const existing = merged[coll][id]\n      if (!existing || envelope._ts >= existing._ts) {\n        merged[coll][id] = envelope\n      }\n    }\n  }\n\n  return merged\n}\n\n// ─── Factory helper ─────────────────────────────────────────────────────\n\n/**\n * Type-safe factory helper for `NoydbPodStore` implementations,\n * analogous to `createStore` for KV stores.\n */\nexport function createPodStore<TOptions>(\n  factory: (options: TOptions) => NoydbPodStore,\n): (options: TOptions) => NoydbPodStore {\n  return factory\n}\n\n// ─── Deprecated aliases (pre-rename compatibility) ──────────────────────\n\n/** @deprecated Use wrapPodStore. */\nexport const wrapBundleStore = wrapPodStore\n/** @deprecated Use createPodStore. */\nexport const createBundleStore = createPodStore\n/** @deprecated Use WrappedPodNoydbStore. */\nexport type WrappedBundleNoydbStore = WrappedPodNoydbStore\n/** @deprecated Use WrapPodStoreOptions. */\nexport type WrapBundleStoreOptions = WrapPodStoreOptions\n","/**\n * Redirect record (#944) — a signed \"this moved, go there\" pointer carried\n * in the pod's PLAINTEXT header (`NoydbPodHeader.redirect`, see\n * `format.ts`) so a dispatcher can follow it pre-auth: no secret, no\n * decompression.\n *\n * The record carries its OWN inner `sig` (via `signRecord`/`verifyRecord`\n * from `signature.ts`) — independent from, and in addition to, the #943\n * pod-header signature. A Redirect is REQUIRED to be signed: there is no\n * legacy unsigned install base for this new record type, so an absent or\n * invalid signature is invalid for following, not merely \"unverified\".\n *\n * Minimum-disclosure: the record is kept to exactly\n * `{ v, target, reason, issuedBy, sig }` — no timestamps, no identities\n * beyond the signer's `keyId` fingerprint.\n */\n\nimport type { DocSigner } from '../with-audit/attestation/signer.js'\nimport { signRecord, verifyRecord } from './signature.js'\nimport { readPodRedirect } from './bundle.js'\nimport {\n  RedirectBadSignatureError,\n  RedirectDepthExceededError,\n  RedirectLoopError,\n  RedirectUnreachableError,\n} from '../kernel/errors.js'\n\n/**\n * A signed pointer to another pod. `target` is a locator string or URL —\n * the forthcoming #945 `Locator` type isn't built yet, so `target` stays a\n * plain string for now (forward-seam noted, not blurred: a Redirect says\n * \"go elsewhere once\"; a Locator will say \"where cargo lives\").\n */\nexport interface Redirect {\n  readonly v: 1\n  readonly target: string\n  readonly reason: 'moved' | 'release' | 'tombstone' | 'repoint'\n  readonly issuedBy: string\n  readonly sig: string\n}\n\n/**\n * Sign a new Redirect record with `signer`. Builds the record minus `sig`,\n * signs it via the #943 `signRecord` convention, and returns the complete\n * signed record.\n */\nexport async function signRedirect(\n  signer: DocSigner,\n  fields: { readonly target: string; readonly reason: Redirect['reason'] },\n): Promise<Redirect> {\n  const record = {\n    v: 1 as const,\n    target: fields.target,\n    reason: fields.reason,\n    issuedBy: signer.keyId,\n  }\n  const sig = await signRecord(signer.privateKeyPkcs8B64, record)\n  return { ...record, sig }\n}\n\n/**\n * Verify a Redirect record's signature against `trustedKeys`\n * (`keyId → publicKeyB64`). Fails closed: an `issuedBy` not present in\n * `trustedKeys` is untrusted/unverifiable and returns `false`, same as a\n * tampered or forged signature.\n */\nexport async function verifyRedirect(\n  record: Redirect,\n  trustedKeys: Readonly<Record<string, string>>,\n): Promise<boolean> {\n  const publicKeyB64 = trustedKeys[record.issuedBy]\n  if (publicKeyB64 === undefined) return false\n  const payload = { v: record.v, target: record.target, reason: record.reason, issuedBy: record.issuedBy }\n  return verifyRecord(publicKeyB64, record.sig, payload)\n}\n\n/** One followed hop's provenance — surfaced so a UI can show \"moved from X via Y\". */\nexport interface RedirectHop {\n  readonly target: string\n  readonly reason: Redirect['reason']\n  readonly issuedBy: string\n}\n\n/** Result of {@link followRedirects}: the terminal (non-redirect) pod's bytes, plus the ordered hop list that led there. */\nexport interface FollowRedirectsResult {\n  readonly terminal: Uint8Array\n  readonly hops: readonly RedirectHop[]\n}\n\n/**\n * Follow a chain of Redirect records starting from `start`'s pod bytes,\n * fetching each hop's target via `fetcher`, until a pod with no `redirect`\n * header field (the terminal) is reached.\n *\n * HTTP-redirect discipline: each hop's Redirect is verified against\n * `opts.trustedKeys` BEFORE it is followed (fail closed — an untrusted or\n * forged hop never advances the walk), loops are detected on the target\n * about to be followed, and the hop count is capped at `opts.maxDepth`\n * (default 8). `fetcher` throwing or returning `null` for a target means\n * that hop is unreachable.\n *\n * @throws {RedirectBadSignatureError} a hop's Redirect fails verification.\n * @throws {RedirectLoopError} a hop's target was already followed in this chain.\n * @throws {RedirectDepthExceededError} more than `maxDepth` hops were followed.\n * @throws {RedirectUnreachableError} `fetcher` threw or returned `null` for a target.\n */\nexport async function followRedirects(\n  start: Uint8Array,\n  fetcher: (target: string) => Promise<Uint8Array | null>,\n  opts: { readonly trustedKeys: Readonly<Record<string, string>>; readonly maxDepth?: number },\n): Promise<FollowRedirectsResult> {\n  const maxDepth = opts.maxDepth ?? 8\n  let current = start\n  const hops: RedirectHop[] = []\n  const visited = new Set<string>()\n\n  for (;;) {\n    const rec = readPodRedirect(current)\n    if (rec === undefined) return { terminal: current, hops }\n\n    if (!(await verifyRedirect(rec, opts.trustedKeys))) {\n      throw new RedirectBadSignatureError(rec.target)\n    }\n    if (visited.has(rec.target)) {\n      throw new RedirectLoopError(rec.target)\n    }\n    visited.add(rec.target)\n\n    hops.push({ target: rec.target, reason: rec.reason, issuedBy: rec.issuedBy })\n    if (hops.length > maxDepth) {\n      throw new RedirectDepthExceededError(maxDepth)\n    }\n\n    let next: Uint8Array | null\n    try {\n      next = await fetcher(rec.target)\n    } catch (cause) {\n      throw new RedirectUnreachableError(rec.target, cause)\n    }\n    if (next === null) {\n      throw new RedirectUnreachableError(rec.target)\n    }\n    current = next\n  }\n}\n","/**\n * `open(podBytesOrFile)` — the pod READ-path orchestrator (#941 Task 4).\n *\n * A free function (never a `Vault` method — `kernel/vault.ts` is at its\n * line ceiling and open() needs no vault-internal state that isn't already\n * reachable through published seams). Composes, in order:\n *\n *   1. `readPod` — parse + integrity-check the container (throws\n *      `BundleIntegrityError` on a corrupted/truncated pod).\n *   2. `verifyPodHeader` — only when `opts.trustedKeys` is supplied.\n *      `'unsigned'` is benign (legacy pod, or `writePod({ sign: false })`)\n *      and open() proceeds; `'untrusted'` / `'tampered'` are fail-closed —\n *      `PodHeaderVerificationError` — mirroring `followRedirects`'s\n *      `RedirectBadSignatureError` posture: once a caller opts into\n *      verification, an unverifiable header is a hard stop.\n *   3. `createNoydb` + `openVault` + `vault.load(dumpJson)` — the exact\n *      unlock+restore sequence `bundle-roundtrip.test.ts` drives by hand.\n *      The pod header carries no vault name (minimum-disclosure —\n *      `format.ts`'s forbidden-fields list), so the caller names the\n *      target vault via `opts.vault`.\n *   4. Re-derive the `SchemaManifest` from the just-restored `_schemas/*`\n *      (the source of truth — Task 3's `deriveSchemaManifest`), via a\n *      NON-MINTING `LookupDEK` built from `loadKeyring`'s already-unwrapped\n *      `UnlockedKeyring.deks` map directly (`with-party/team/keyring.js`).\n *      **Not** `ensureCollectionDEK` (#941 review fix — Important 2): that\n *      helper mints+persists a fresh DEK into `_keyring/<user>` for any\n *      collection absent from the keyring, which is correct for a WRITE\n *      path but wrong here — `deriveSchemaManifest` only ever reads\n *      collections that already have a `_schemas` envelope, so an absent\n *      DEK means \"this principal can't decrypt this sibling\" (e.g. a\n *      collection-scoped grantee), never \"new collection.\" The old\n *      minting call polluted a scoped principal's freshly-restored keyring\n *      with garbage sibling DEKs on every `open()`. The returned\n *      `manifest` is that principal's own visible slice — see\n *      `derive.ts`'s `LookupDEK` doc and `sync.ts`'s module doc for the\n *      full rationale (the same distinction governs why the sync path\n *      must SKIP rather than write a partial manifest).\n *   5. Generation check (AC #4 coexistence): compare the HIGHEST\n *      per-collection generation stamp carried by the restored manifest\n *      against THIS store's schema-fence generation as it stood\n *      immediately before the restore (0 for a brand-new vault; whatever a\n *      coexisting local vault already had). If the pod is ahead and\n *      `!opts.allowGenerationAhead`, throw `MigrationRequiredError` (the\n *      same class `SchemaFenceController`'s write-path gate throws) — the\n *      reader hasn't reconciled schema changes that happened elsewhere.\n *      `allowGenerationAhead: true` is the documented dev override: open\n *      proceeds, with a console warning. Divergence in the OTHER direction\n *      (reader ahead of the pod) is non-fatal but also warned (#941\n *      review, Important 3 — AC #4 coexistence divergence must be\n *      observable in either direction, not just the bypass case).\n *\n *      NOTE: this deliberately reads per-collection entries, not\n *      `manifest.generation` itself. `_meta/schema-fence` is local\n *      session-coordination state and does NOT travel in a pod dump\n *      (`with-pod/backup.ts`'s reserved-collection list carries `_schemas`\n *      and `_manifest` but not `_meta`) — a fresh re-derive's top-level\n *      `generation` is always driven by the (untouched-by-restore) target\n *      store's own fence, not the pod's. Each `_schemas/<collection>`\n *      envelope's own `generation` field DOES travel (it's stamped at\n *      declare-time from the writer's real fence), so per-collection\n *      entries are the only signal that survives a restore intact.\n *\n * @module\n */\n\nimport { readPod, verifyPodHeader } from './bundle.js'\nimport type { NoydbPodHeader } from './format.js'\nimport type { PodVerifyResult } from './bundle.js'\nimport { createNoydb } from '../kernel/noydb.js'\nimport type { Noydb } from '../kernel/noydb.js'\nimport type { Vault } from '../kernel/vault.js'\nimport type { NoydbOptions, NoydbStore, EchoSecretParts } from '../kernel/types.js'\nimport { MigrationRequiredError, PodHeaderVerificationError } from '../kernel/errors.js'\nimport { loadKeyring } from '../with-party/team/keyring.js'\nimport { loadFence } from '../with-shape/schema-update/fence.js'\nimport { deriveSchemaManifest, type LookupDEK } from '../with-shape/manifest/derive.js'\nimport type { SchemaManifest } from '../with-shape/manifest/types.js'\n\nexport interface OpenPodOptions {\n  /** The ciphertext store to restore into (and where the opened `Vault` lives). */\n  readonly store: NoydbStore\n  /**\n   * The target vault name. The pod header deliberately carries no vault\n   * name (minimum-disclosure — `NoydbPodHeader`'s forbidden-fields list),\n   * so the caller names the vault to restore into/open.\n   */\n  readonly vault: string\n  /** User identifier — passed through to `createNoydb`. */\n  readonly user: string\n  /** That user's secret — passed through to `createNoydb` / `loadKeyring`. */\n  readonly secret: string | EchoSecretParts\n  /**\n   * Trusted signing keys (`keyId → publicKeyB64`). When supplied,\n   * `verifyPodHeader` runs and its result is returned as `verification`.\n   * Omitted → no verification attempted, `verification` is absent.\n   */\n  readonly trustedKeys?: Readonly<Record<string, string>>\n  /**\n   * Passthrough to `createNoydb` for every option beyond `store`/`user`/\n   * `secret` (history/indexing/blobs/… strategies, `secretMode`, etc.).\n   */\n  readonly noydbOptions?: Omit<NoydbOptions, 'store' | 'user' | 'secret'>\n  /**\n   * Dev override for the generation-ahead fence (AC #4). Default `false`:\n   * a pod whose schema manifest generation is ahead of this store's\n   * pre-restore fence generation throws `MigrationRequiredError`. `true`\n   * opens anyway, logging a console warning.\n   */\n  readonly allowGenerationAhead?: boolean\n}\n\nexport interface OpenPodResult {\n  readonly db: Noydb\n  readonly vault: Vault\n  readonly header: NoydbPodHeader\n  /** Present iff `opts.trustedKeys` was supplied. */\n  readonly verification?: PodVerifyResult\n  /** The pod's schema manifest, re-derived from the just-restored `_schemas/*`. */\n  readonly manifest?: SchemaManifest\n}\n\n/**\n * Open a `.noydb` pod: verify its integrity (and, opt-in, its signature),\n * unlock + restore it into `opts.vault`, and re-derive its schema manifest.\n * See the module doc for the full flow and the errors each step can throw.\n */\nexport async function open(podFileOrBytes: Uint8Array, opts: OpenPodOptions): Promise<OpenPodResult> {\n  const { header, dumpJson } = await readPod(podFileOrBytes)\n\n  let verification: PodVerifyResult | undefined\n  if (opts.trustedKeys !== undefined) {\n    verification = await verifyPodHeader(podFileOrBytes, opts.trustedKeys)\n    if (verification.status === 'untrusted' || verification.status === 'tampered') {\n      throw new PodHeaderVerificationError(verification.status, verification.keyId)\n    }\n  }\n\n  // Reader's pre-restore generation snapshot (see module doc, step 5) —\n  // must be read from the raw store BEFORE vault.load() overwrites it.\n  const readerGeneration = (await loadFence(opts.store, opts.vault)).currentSchemaVersion\n\n  const db = await createNoydb({ ...opts.noydbOptions, store: opts.store, user: opts.user, secret: opts.secret })\n  const vault = await db.openVault(opts.vault)\n  await vault.load(dumpJson)\n\n  // #941 review fix: a NON-MINTING lookup, not `ensureCollectionDEK` (which\n  // mints+persists a fresh DEK for any collection absent from the keyring).\n  // open() is a READ path — deriveSchemaManifest only ever iterates\n  // collections that already have a `_schemas` envelope, so an absent DEK\n  // here means \"this principal cannot decrypt this sibling,\" never \"new\n  // collection.\" The old minting call polluted a scoped principal's just-\n  // restored `_keyring/<user>` file with garbage sibling DEKs on every\n  // open(). See `derive.ts`'s `LookupDEK` doc for the full rationale.\n  const keyring = await loadKeyring(opts.store, opts.vault, { userId: opts.user, secret: opts.secret })\n  const lookupDEK: LookupDEK = async (name) => keyring.deks.get(name)\n  const { manifest, undecodableCollections } = await deriveSchemaManifest(opts.store, opts.vault, lookupDEK)\n\n  // A scoped principal's `manifest` is legitimately their own visible\n  // slice (see `sync.ts`'s module doc) — `open()` is a per-principal read,\n  // not an assertion of pod-wide completeness. `undecodableCollections` is\n  // intentionally not surfaced on `OpenPodResult` (out of this fix's\n  // scope); callers that need it can call `deriveSchemaManifest` directly.\n  void undecodableCollections\n\n  // See module doc, step 5 — the pod's generation signal is the highest\n  // per-collection stamp, not the (locally re-derived, fence-driven)\n  // top-level `manifest.generation`.\n  const podGeneration = Object.values(manifest.collections)\n    .reduce((max, entry) => Math.max(max, entry.generation), 0)\n\n  if (podGeneration > readerGeneration) {\n    if (!opts.allowGenerationAhead) {\n      throw new MigrationRequiredError(\n        `open(): pod's schema generation (${podGeneration}) is ahead of vault ` +\n          `\"${opts.vault}\"'s local generation (${readerGeneration}). Pass ` +\n          `\\`allowGenerationAhead: true\\` to open anyway, or reconcile the schema first.`,\n      )\n    }\n    console.warn(\n      `[noy-db] open(): vault \"${opts.vault}\" opened with allowGenerationAhead — pod schema ` +\n        `generation ${podGeneration} is ahead of the local generation ${readerGeneration}.`,\n    )\n  } else if (podGeneration < readerGeneration) {\n    // #941 review (Important 3, AC #4): divergence in EITHER direction\n    // should be observable, not just the ahead-bypass case above. The\n    // reader being ahead of the pod is non-fatal (the pod is simply older\n    // content) but silent coexistence divergence is exactly what AC #4\n    // asks to surface — same `[noy-db]`-prefixed console.warn facility as\n    // `sync.ts`'s cap-exhaustion warning.\n    console.warn(\n      `[noy-db] open(): vault \"${opts.vault}\"'s local schema generation (${readerGeneration}) is ` +\n        `ahead of the pod's (${podGeneration}) — the pod reflects an earlier schema than this reader.`,\n    )\n  }\n\n  return { db, vault, header, manifest, ...(verification !== undefined ? { verification } : {}) }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAKA,IAAM,uBAAuB;AA4C7B,IAAM,uBAAuB;AAwBtB,SAAS,aACd,QACA,SACsB;AACtB,QAAM,YAAY,SAAS,cAAc;AAGzC,QAAM,YAAY,oBAAI,IAA2B;AACjD,QAAM,WAAW,oBAAI,IAA2B;AAChD,QAAM,SAAS,oBAAI,IAAY;AAG/B,MAAI,aAAa;AAMjB,QAAM,UAAU,oBAAI,IAAoC;AAExD,iBAAe,KAAK,OAAuC;AACzD,QAAI,OAAO,IAAI,KAAK,EAAG,QAAO,UAAU,IAAI,KAAK;AAEjD,UAAM,WAAW,QAAQ,IAAI,KAAK;AAClC,QAAI,SAAU,QAAO;AAErB,UAAM,WAAW,YAAY;AAC3B,YAAM,SAAS,MAAM,OAAO,WAAW,KAAK;AAC5C,UAAI,QAAQ;AACV,cAAM,OAAO,IAAI,YAAY,EAAE,OAAO,OAAO,KAAK;AAClD,cAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,kBAAU,IAAI,OAAO,OAAO,IAAI;AAChC,iBAAS,IAAI,OAAO,OAAO,OAAO;AAAA,MACpC,OAAO;AACL,kBAAU,IAAI,OAAO,CAAC,CAAC;AACvB,iBAAS,IAAI,OAAO,IAAI;AAAA,MAC1B;AAEA,aAAO,IAAI,KAAK;AAChB,aAAO,UAAU,IAAI,KAAK;AAAA,IAC5B,GAAG;AAEH,YAAQ,IAAI,OAAO,OAAO;AAC1B,QAAI;AACF,aAAO,MAAM;AAAA,IACf,UAAE;AAGA,cAAQ,OAAO,KAAK;AAAA,IACtB;AAAA,EACF;AAEA,iBAAe,MAAM,OAA8B;AACjD,UAAM,WAAW,UAAU,IAAI,KAAK,KAAK,CAAC;AAC1C,UAAM,SAA0B;AAAA,MAC9B,qBAAqB;AAAA,MACrB;AAAA,MACA,KAAI,oBAAI,KAAK,GAAE,YAAY;AAAA,MAC3B,MAAM;AAAA,IACR;AACA,UAAM,QAAQ,IAAI,YAAY,EAAE,OAAO,KAAK,UAAU,MAAM,CAAC;AAC7D,UAAM,kBAAkB,SAAS,IAAI,KAAK,KAAK;AAE/C,aAAS,UAAU,GAAG,UAAU,sBAAsB,WAAW;AAC/D,UAAI;AACF,cAAM,EAAE,SAAS,WAAW,IAAI,MAAM,OAAO,YAAY,OAAO,OAAO,eAAe;AACtF,iBAAS,IAAI,OAAO,UAAU;AAC9B;AAAA,MACF,SAAS,KAAK;AACZ,YAAI,eAAe,2BAA2B,UAAU,uBAAuB,GAAG;AAEhF,gBAAM,SAAS,MAAM,OAAO,WAAW,KAAK;AAC5C,cAAI,QAAQ;AACV,kBAAM,aAAa,IAAI,YAAY,EAAE,OAAO,OAAO,KAAK;AACxD,kBAAM,eAAe,KAAK,MAAM,UAAU;AAC1C,kBAAM,YAAY,UAAU,IAAI,KAAK,KAAK,CAAC;AAC3C,kBAAM,aAAa,eAAe,aAAa,MAAM,SAAS;AAC9D,sBAAU,IAAI,OAAO,UAAU;AAC/B,qBAAS,IAAI,OAAO,OAAO,OAAO;AAAA,UACpC;AAEA;AAAA,QACF;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAQA,QAAM,aAAa,oBAAI,IAA2B;AAElD,WAAS,YAAY,OAA8B;AACjD,UAAM,OAAO,WAAW,IAAI,KAAK,KAAK,QAAQ,QAAQ;AAGtD,UAAM,OAAO,KAAK,KAAK,MAAM,MAAM,KAAK,GAAG,MAAM,MAAM,KAAK,CAAC;AAC7D,eAAW,IAAI,OAAO,IAAI;AAC1B,WAAO;AAAA,EACT;AAEA,iBAAe,WAAW,OAA8B;AACtD,QAAI,aAAa,eAAe,GAAG;AACjC,YAAM,YAAY,KAAK;AAAA,IACzB;AAAA,EACF;AAEA,QAAM,QAA8B;AAAA,IAClC,MAAM,OAAO,QAAQ;AAAA,IAErB,MAAM,MAAM,SAAgC;AAC1C,YAAM,YAAY,OAAO;AAAA,IAC3B;AAAA,IAEA,MAAM,MAAM,SAAiB,IAAwC;AACnE,YAAM,KAAK,OAAO;AAClB;AACA,UAAI;AACF,cAAM,GAAG;AAAA,MACX,UAAE;AACA;AAAA,MACF;AACA,YAAM,YAAY,OAAO;AAAA,IAC3B;AAAA,IAEA,MAAM,IAAI,OAAe,YAAoB,IAA+C;AAC1F,YAAM,OAAO,MAAM,KAAK,KAAK;AAC7B,aAAO,KAAK,UAAU,IAAI,EAAE,KAAK;AAAA,IACnC;AAAA,IAEA,MAAM,IACJ,OACA,YACA,IACA,UACA,iBACe;AACf,YAAM,OAAO,MAAM,KAAK,KAAK;AAE7B,UAAI,oBAAoB,QAAW;AACjC,cAAM,UAAU,KAAK,UAAU,IAAI,EAAE;AACrC,cAAM,iBAAiB,SAAS,MAAM;AACtC,YAAI,mBAAmB,iBAAiB;AACtC,gBAAM,IAAI;AAAA,YACR;AAAA,YACA,oBAAoB,eAAe,cAAc,cAAc,OAAO,UAAU,IAAI,EAAE;AAAA,UACxF;AAAA,QACF;AAAA,MACF;AAEA,WAAK,UAAU,MAAM,CAAC;AACtB,WAAK,UAAU,EAAE,EAAE,IAAI;AACvB,YAAM,WAAW,KAAK;AAAA,IACxB;AAAA,IAEA,MAAM,OAAO,OAAe,YAAoB,IAA2B;AACzE,YAAM,OAAO,MAAM,KAAK,KAAK;AAC7B,UAAI,KAAK,UAAU,GAAG;AACpB,eAAO,KAAK,UAAU,EAAE,EAAE;AAC1B,cAAM,WAAW,KAAK;AAAA,MACxB;AAAA,IACF;AAAA,IAEA,MAAM,KAAK,OAAe,YAAuC;AAC/D,YAAM,OAAO,MAAM,KAAK,KAAK;AAC7B,aAAO,OAAO,KAAK,KAAK,UAAU,KAAK,CAAC,CAAC;AAAA,IAC3C;AAAA,IAEA,MAAM,QAAQ,OAAuC;AACnD,YAAM,OAAO,MAAM,KAAK,KAAK;AAS7B,YAAM,MAAqB,CAAC;AAC5B,iBAAW,CAAC,YAAY,OAAO,KAAK,OAAO,QAAQ,IAAI,GAAG;AACxD,YAAI,WAAW,WAAW,GAAG,EAAG;AAChC,YAAI,UAAU,IAAI,EAAE,GAAG,QAAQ;AAAA,MACjC;AACA,aAAO;AAAA,IACT;AAAA,IAEA,MAAM,QAAQ,OAAe,MAAoC;AAC/D,gBAAU,IAAI,OAAO,IAAI;AACzB,aAAO,IAAI,KAAK;AAChB,YAAM,YAAY,KAAK;AAAA,IACzB;AAAA,EACF;AAEA,SAAO;AACT;AAIA,SAAS,eAAe,QAAuB,OAAqC;AAClF,QAAM,SAAwB,CAAC;AAG/B,aAAW,CAAC,MAAM,OAAO,KAAK,OAAO,QAAQ,MAAM,GAAG;AACpD,WAAO,IAAI,IAAI,EAAE,GAAG,QAAQ;AAAA,EAC9B;AAGA,aAAW,CAAC,MAAM,OAAO,KAAK,OAAO,QAAQ,KAAK,GAAG;AACnD,QAAI,CAAC,OAAO,IAAI,GAAG;AACjB,aAAO,IAAI,IAAI,EAAE,GAAG,QAAQ;AAC5B;AAAA,IACF;AACA,eAAW,CAAC,IAAI,QAAQ,KAAK,OAAO,QAAQ,OAAO,GAAG;AACpD,YAAM,WAAW,OAAO,IAAI,EAAE,EAAE;AAChC,UAAI,CAAC,YAAY,SAAS,OAAO,SAAS,KAAK;AAC7C,eAAO,IAAI,EAAE,EAAE,IAAI;AAAA,MACrB;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAQO,SAAS,eACd,SACsC;AACtC,SAAO;AACT;AAKO,IAAM,kBAAkB;AAExB,IAAM,oBAAoB;;;AC/QjC,eAAsB,aACpB,QACA,QACmB;AACnB,QAAM,SAAS;AAAA,IACb,GAAG;AAAA,IACH,QAAQ,OAAO;AAAA,IACf,QAAQ,OAAO;AAAA,IACf,UAAU,OAAO;AAAA,EACnB;AACA,QAAM,MAAM,MAAM,WAAW,OAAO,oBAAoB,MAAM;AAC9D,SAAO,EAAE,GAAG,QAAQ,IAAI;AAC1B;AAQA,eAAsB,eACpB,QACA,aACkB;AAClB,QAAM,eAAe,YAAY,OAAO,QAAQ;AAChD,MAAI,iBAAiB,OAAW,QAAO;AACvC,QAAM,UAAU,EAAE,GAAG,OAAO,GAAG,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,UAAU,OAAO,SAAS;AACvG,SAAO,aAAa,cAAc,OAAO,KAAK,OAAO;AACvD;AAgCA,eAAsB,gBACpB,OACA,SACA,MACgC;AAChC,QAAM,WAAW,KAAK,YAAY;AAClC,MAAI,UAAU;AACd,QAAM,OAAsB,CAAC;AAC7B,QAAM,UAAU,oBAAI,IAAY;AAEhC,aAAS;AACP,UAAM,MAAM,gBAAgB,OAAO;AACnC,QAAI,QAAQ,OAAW,QAAO,EAAE,UAAU,SAAS,KAAK;AAExD,QAAI,CAAE,MAAM,eAAe,KAAK,KAAK,WAAW,GAAI;AAClD,YAAM,IAAI,0BAA0B,IAAI,MAAM;AAAA,IAChD;AACA,QAAI,QAAQ,IAAI,IAAI,MAAM,GAAG;AAC3B,YAAM,IAAI,kBAAkB,IAAI,MAAM;AAAA,IACxC;AACA,YAAQ,IAAI,IAAI,MAAM;AAEtB,SAAK,KAAK,EAAE,QAAQ,IAAI,QAAQ,QAAQ,IAAI,QAAQ,UAAU,IAAI,SAAS,CAAC;AAC5E,QAAI,KAAK,SAAS,UAAU;AAC1B,YAAM,IAAI,2BAA2B,QAAQ;AAAA,IAC/C;AAEA,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,QAAQ,IAAI,MAAM;AAAA,IACjC,SAAS,OAAO;AACd,YAAM,IAAI,yBAAyB,IAAI,QAAQ,KAAK;AAAA,IACtD;AACA,QAAI,SAAS,MAAM;AACjB,YAAM,IAAI,yBAAyB,IAAI,MAAM;AAAA,IAC/C;AACA,cAAU;AAAA,EACZ;AACF;;;AClBA,eAAsB,KAAK,gBAA4B,MAA8C;AACnG,QAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,QAAQ,cAAc;AAEzD,MAAI;AACJ,MAAI,KAAK,gBAAgB,QAAW;AAClC,mBAAe,MAAM,gBAAgB,gBAAgB,KAAK,WAAW;AACrE,QAAI,aAAa,WAAW,eAAe,aAAa,WAAW,YAAY;AAC7E,YAAM,IAAI,2BAA2B,aAAa,QAAQ,aAAa,KAAK;AAAA,IAC9E;AAAA,EACF;AAIA,QAAM,oBAAoB,MAAM,UAAU,KAAK,OAAO,KAAK,KAAK,GAAG;AAEnE,QAAM,KAAK,MAAM,YAAY,EAAE,GAAG,KAAK,cAAc,OAAO,KAAK,OAAO,MAAM,KAAK,MAAM,QAAQ,KAAK,OAAO,CAAC;AAC9G,QAAM,QAAQ,MAAM,GAAG,UAAU,KAAK,KAAK;AAC3C,QAAM,MAAM,KAAK,QAAQ;AAUzB,QAAM,UAAU,MAAM,YAAY,KAAK,OAAO,KAAK,OAAO,EAAE,QAAQ,KAAK,MAAM,QAAQ,KAAK,OAAO,CAAC;AACpG,QAAM,YAAuB,OAAO,SAAS,QAAQ,KAAK,IAAI,IAAI;AAClE,QAAM,EAAE,UAAU,uBAAuB,IAAI,MAAM,qBAAqB,KAAK,OAAO,KAAK,OAAO,SAAS;AAOzG,OAAK;AAKL,QAAM,gBAAgB,OAAO,OAAO,SAAS,WAAW,EACrD,OAAO,CAAC,KAAK,UAAU,KAAK,IAAI,KAAK,MAAM,UAAU,GAAG,CAAC;AAE5D,MAAI,gBAAgB,kBAAkB;AACpC,QAAI,CAAC,KAAK,sBAAsB;AAC9B,YAAM,IAAI;AAAA,QACR,oCAAoC,aAAa,wBAC3C,KAAK,KAAK,yBAAyB,gBAAgB;AAAA,MAE3D;AAAA,IACF;AACA,YAAQ;AAAA,MACN,2BAA2B,KAAK,KAAK,mEACrB,aAAa,qCAAqC,gBAAgB;AAAA,IACpF;AAAA,EACF,WAAW,gBAAgB,kBAAkB;AAO3C,YAAQ;AAAA,MACN,2BAA2B,KAAK,KAAK,gCAAgC,gBAAgB,4BAC5D,aAAa;AAAA,IACxC;AAAA,EACF;AAEA,SAAO,EAAE,IAAI,OAAO,QAAQ,UAAU,GAAI,iBAAiB,SAAY,EAAE,aAAa,IAAI,CAAC,EAAG;AAChG;","names":[]}

package/dist/chunk-CDB2HVQW.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-shape/persisted-schemas/storage.ts"],"sourcesContent":["/**\n * Read / write the per-collection persisted-schema envelope. Mirrors the\n * standard noy-db record envelope shape and is **AES-GCM encrypted with\n * the collection's DEK** — the schema body (field names, enum values,\n * constraints) is sensitive metadata, so it gets the same encryption\n * envelope as the records it describes.\n *\n * Storage layout:\n *\n *   <vault>/_schemas/<collection>   →   EncryptedEnvelope\n *\n * The DEK passed to {@link savePersistedSchema} / {@link loadPersistedSchema}\n * is the same key the collection uses for its records.\n *\n * @module\n */\n\nimport { encrypt, openEnvelopeJson, type EnclaveKey } from '../../kernel/enclave/index.js'\nimport { NOYDB_FORMAT_VERSION } from '../../kernel/types.js'\nimport type { NoydbStore, EncryptedEnvelope } from '../../kernel/types.js'\nimport type { PersistedSchemaEnvelope } from './types.js'\n\n/** Reserved collection name where persisted schemas live. */\nexport const SCHEMAS_COLLECTION = '_schemas' as const\n\n/**\n * A decrypted persisted-schema read paired with the wrapping envelope's\n * `_v`. The version is the optimistic-concurrency token: pass it back to\n * {@link savePersistedSchema} as `expectedVersion` to make the write a CAS\n * that rejects a stale put (see #583 — the `_schemas` record is shared by\n * the JSON-Schema writer and the classified-marker writer).\n */\nexport interface PersistedSchemaEntry {\n  /** Wrapping envelope `_v` (0 when no record exists yet). */\n  readonly version: number\n  /** Decrypted payload, or `undefined` when absent/corrupt/wrong-DEK. */\n  readonly payload: PersistedSchemaEnvelope | undefined\n}\n\n/**\n * Read the persisted-schema envelope for one collection together with its\n * wrapping `_v`. The version reflects the raw stored envelope even when the\n * payload cannot be decrypted/parsed (so a CAS still guards a corrupt record\n * rather than silently clobbering it).\n */\nexport async function loadPersistedSchemaEntry(\n  store: NoydbStore,\n  vault: string,\n  collection: string,\n  dek: EnclaveKey,\n): Promise<PersistedSchemaEntry> {\n  const envelope = await store.get(vault, SCHEMAS_COLLECTION, collection)\n  if (!envelope) return { version: 0, payload: undefined }\n  const version = envelope._v\n  try {\n    const plaintext = await openEnvelopeJson(envelope, dek)\n    const parsed = JSON.parse(plaintext) as PersistedSchemaEnvelope\n    if (parsed._noydb_schema !== 1) return { version, payload: undefined }\n    return { version, payload: parsed }\n  } catch {\n    return { version, payload: undefined }\n  }\n}\n\n/**\n * Read and decrypt the persisted-schema envelope for one collection.\n * Returns `undefined` when no envelope has been written or when decryption\n * fails (e.g. wrong DEK passed). Tolerates corrupted records — JSON parse\n * failures surface as `undefined`, mirroring `_meta/handle`'s contract.\n */\nexport async function loadPersistedSchema(\n  store: NoydbStore,\n  vault: string,\n  collection: string,\n  dek: EnclaveKey,\n): Promise<PersistedSchemaEnvelope | undefined> {\n  return (await loadPersistedSchemaEntry(store, vault, collection, dek)).payload\n}\n\n/**\n * Encrypt and persist a schema envelope for one collection. Always\n * overwrites any prior write (callers gate on hash equality before calling\n * to avoid no-op writes).\n *\n * Pass `expectedVersion` — the `version` from {@link loadPersistedSchemaEntry}\n * captured at load time — to make the write an optimistic CAS: on a store with\n * `casAtomic`, `store.put` throws {@link ConflictError} when the record was\n * bumped concurrently, so a lost update on the shared `_schemas` record is\n * rejected instead of silently clobbering the other writer's field (#583).\n * When omitted, keeps the legacy unconditional last-writer-wins behaviour.\n */\nexport async function savePersistedSchema(\n  store: NoydbStore,\n  vault: string,\n  collection: string,\n  dek: EnclaveKey,\n  payload: PersistedSchemaEnvelope,\n  expectedVersion?: number,\n): Promise<void> {\n  const json = JSON.stringify(payload)\n  const { iv, data } = await encrypt(json, dek)\n  const baseVersion = expectedVersion ?? (await store.get(vault, SCHEMAS_COLLECTION, collection))?._v ?? 0\n  const env: EncryptedEnvelope = {\n    _noydb: NOYDB_FORMAT_VERSION,\n    _v: baseVersion + 1,\n    _ts: new Date().toISOString(),\n    _iv: iv,\n    _data: data,\n  }\n  await store.put(vault, SCHEMAS_COLLECTION, collection, env, expectedVersion)\n}\n"],"mappings":";;;;;;;;;;;AAuBO,IAAM,qBAAqB;AAsBlC,eAAsB,yBACpB,OACA,OACA,YACA,KAC+B;AAC/B,QAAM,WAAW,MAAM,MAAM,IAAI,OAAO,oBAAoB,UAAU;AACtE,MAAI,CAAC,SAAU,QAAO,EAAE,SAAS,GAAG,SAAS,OAAU;AACvD,QAAM,UAAU,SAAS;AACzB,MAAI;AACF,UAAM,YAAY,MAAM,iBAAiB,UAAU,GAAG;AACtD,UAAM,SAAS,KAAK,MAAM,SAAS;AACnC,QAAI,OAAO,kBAAkB,EAAG,QAAO,EAAE,SAAS,SAAS,OAAU;AACrE,WAAO,EAAE,SAAS,SAAS,OAAO;AAAA,EACpC,QAAQ;AACN,WAAO,EAAE,SAAS,SAAS,OAAU;AAAA,EACvC;AACF;AAQA,eAAsB,oBACpB,OACA,OACA,YACA,KAC8C;AAC9C,UAAQ,MAAM,yBAAyB,OAAO,OAAO,YAAY,GAAG,GAAG;AACzE;AAcA,eAAsB,oBACpB,OACA,OACA,YACA,KACA,SACA,iBACe;AACf,QAAM,OAAO,KAAK,UAAU,OAAO;AACnC,QAAM,EAAE,IAAI,KAAK,IAAI,MAAM,QAAQ,MAAM,GAAG;AAC5C,QAAM,cAAc,oBAAoB,MAAM,MAAM,IAAI,OAAO,oBAAoB,UAAU,IAAI,MAAM;AACvG,QAAM,MAAyB;AAAA,IAC7B,QAAQ;AAAA,IACR,IAAI,cAAc;AAAA,IAClB,MAAK,oBAAI,KAAK,GAAE,YAAY;AAAA,IAC5B,KAAK;AAAA,IACL,OAAO;AAAA,EACT;AACA,QAAM,MAAM,IAAI,OAAO,oBAAoB,YAAY,KAAK,eAAe;AAC7E;","names":[]}

package/dist/chunk-CEJWMBXO.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-formula/materialized-views/with-materialized-view.ts"],"sourcesContent":["import { MaterializedViewConfigError, ValidationError } from '../../kernel/errors.js'\nimport type { MaterializedViewSpec, MaterializedViewStrategy } from './types.js'\n\n/**\n * Register a materialized view: a declared query whose result is\n * persisted as a queryable collection and kept fresh as sources\n * change. Writes go through the standard `Collection.put` pipeline;\n * refresh-driven deletes route through `Collection._internalDelete` so\n * user `onDelete` guards on the output collection aren't tripped by\n * housekeeping.\n *\n * Three registration modes:\n *   - **single-source** — declare `query: (db) => Query<TRow>`; the\n *     dependency analyzer derives source collections from the plan.\n *   - **UNION** — declare `unionSources: [{ collection, map }, ...]`\n *     plus optional `groupBy` + `aggregate`; the executor reads each\n *     arm, maps to the unified row shape, concatenates, then groups\n *     and aggregates.\n *   - **projection** (#810) — declare `projection: { source, joins,\n *     map }`; one output row per primary record, enriched with\n *     forward FK legs and reverse \"collect\" legs before `map` runs.\n *\n * The three modes are mutually exclusive — exactly one of `query` /\n * `unionSources` / `projection` must be set at registration time.\n *\n * See design-history/2026-05-20-dim14-mv-v2-design.md (single-source v2),\n * design-history/2026-05-21-dim14-mv-multikey-and-union.md (UNION),\n * and design-history/2026-07-25-join-projection-mv-design.md (projection).\n */\nexport function withMaterializedView<TRow extends Record<string, unknown>>(\n  spec: MaterializedViewSpec<TRow>,\n): MaterializedViewStrategy {\n  if (!spec.name || spec.name.length === 0) {\n    throw new ValidationError('withMaterializedView: name is required')\n  }\n  // Mutual exclusion: exactly one of the three forms must be declared.\n  const declaredForms = [spec.query, spec.unionSources, spec.projection]\n    .filter((f) => f !== undefined).length\n  if (declaredForms > 1) {\n    throw new MaterializedViewConfigError(\n      'query, unionSources, and projection are mutually exclusive — pick one',\n    )\n  }\n  if (declaredForms === 0) {\n    throw new MaterializedViewConfigError(\n      'strategy must declare exactly one of query, unionSources, or projection',\n    )\n  }\n  if (spec.query !== undefined && typeof spec.query !== 'function') {\n    throw new ValidationError('withMaterializedView: query must be a function returning a Query<T>')\n  }\n  // UNION-form invariants.\n  if (spec.unionSources) {\n    // A single arm is a deliberate shape: map→group→aggregate over\n    // ONE collection with a COMPUTED bucket key (e.g. month sliced from a\n    // date field) — something the query form's stored-field groupBy cannot\n    // express. The executor and dependency analyzer are arm-count-agnostic.\n    if (spec.unionSources.length < 1) {\n      throw new MaterializedViewConfigError(\n        'unionSources requires at least 1 source collection',\n      )\n    }\n    const seen = new Set<string>()\n    for (const s of spec.unionSources) {\n      if (typeof s?.collection !== 'string' || s.collection.length === 0) {\n        throw new MaterializedViewConfigError(\n          'each unionSources entry must declare a non-empty `collection` string',\n        )\n      }\n      if (typeof s.map !== 'function') {\n        throw new MaterializedViewConfigError(\n          `unionSources entry for \"${s.collection}\" is missing a \\`map\\` function`,\n        )\n      }\n      if (seen.has(s.collection)) {\n        throw new MaterializedViewConfigError(\n          `unionSources must reference distinct collections (duplicate: \"${s.collection}\")`,\n        )\n      }\n      seen.add(s.collection)\n    }\n    if (Array.isArray(spec.groupBy) && spec.groupBy.length === 0) {\n      throw new MaterializedViewConfigError(\n        `withMaterializedView \"${spec.name}\": groupBy must not be an empty array — omit it or provide at least one field name`,\n      )\n    }\n    if (spec.aggregate && !spec.groupBy) {\n      throw new MaterializedViewConfigError(\n        `withMaterializedView \"${spec.name}\": UNION strategy with aggregate requires groupBy — `\n        + `use groupBy to declare the bucketing keys, or remove aggregate for a pure dedup MV`,\n      )\n    }\n    // `moneyFields` only has meaning when there's an aggregate to\n    // money-rewrite — it keys reducer outputs, so declaring it without\n    // `aggregate` is a no-op config mistake.\n    if (spec.moneyFields && !spec.aggregate) {\n      throw new MaterializedViewConfigError(\n        `withMaterializedView \"${spec.name}\": moneyFields requires aggregate — `\n        + `moneyFields rewrites sum/min/max reducers over money output fields, `\n        + `so it is meaningless without an aggregate spec`,\n      )\n    }\n    // Per-arm joins resolve right-side collections that the union\n    // dependency set (built from arm `collection`s alone) does NOT\n    // include. The consumer must list those right-side collections in\n    // `sources` so writes to them trigger MV refresh.\n    if (spec.unionSources.some(s => s.join && s.join.length > 0) && (!spec.sources || spec.sources.length === 0)) {\n      throw new MaterializedViewConfigError(\n        `withMaterializedView \"${spec.name}\": a unionSources arm declares join(s) but `\n        + `no \\`sources\\` are listed — declare sources: [...] with the right-side `\n        + `(join-target) collection names so writes to them trigger MV refresh`,\n      )\n    }\n    if (spec.predicates) {\n      throw new MaterializedViewConfigError(\n        `withMaterializedView \"${spec.name}\": predicates are not supported on UNION strategies — `\n        + `UNION mode does not use a Query<T> chain, so .wherePredicate() cannot fire. `\n        + `Use the query() form, or open an issue if per-arm predicates are needed`,\n      )\n    }\n  }\n  // Projection-form invariants (#810). Shape checks only — the\n  // semantic ref() check on collect legs (the `on` field must carry a\n  // ref() targeting the projection source) runs at first\n  // materialization, parity with join-time ref errors.\n  if (spec.projection) {\n    const projection = spec.projection\n    if (typeof projection.source !== 'string' || projection.source.length === 0) {\n      throw new MaterializedViewConfigError(\n        `withMaterializedView \"${spec.name}\": projection.source must be a non-empty collection name`,\n      )\n    }\n    if (typeof projection.map !== 'function') {\n      throw new MaterializedViewConfigError(\n        `withMaterializedView \"${spec.name}\": projection is missing a \\`map\\` function`,\n      )\n    }\n    if (!Array.isArray(projection.joins) || projection.joins.length < 1) {\n      throw new MaterializedViewConfigError(\n        `withMaterializedView \"${spec.name}\": projection.joins must declare at least 1 leg — `\n        + `a leg-less single-source MV is the query() form's job`,\n      )\n    }\n    const seenAs = new Set<string>()\n    for (const leg of projection.joins) {\n      const l = leg as { field?: unknown; collect?: unknown; on?: unknown; as?: unknown }\n      const isForward = l.field !== undefined\n      const isCollect = l.collect !== undefined\n      if (isForward && isCollect) {\n        throw new MaterializedViewConfigError(\n          `withMaterializedView \"${spec.name}\": a projection leg cannot declare both \\`field\\` `\n          + `(forward) and \\`collect\\` (reverse) — split it into two legs`,\n        )\n      }\n      if (!isForward && !isCollect) {\n        throw new MaterializedViewConfigError(\n          `withMaterializedView \"${spec.name}\": each projection leg must declare either \\`field\\` `\n          + `(forward FK) or \\`collect\\` (reverse one-to-many)`,\n        )\n      }\n      if (isForward && (typeof l.field !== 'string' || l.field.length === 0)) {\n        throw new MaterializedViewConfigError(\n          `withMaterializedView \"${spec.name}\": a forward projection leg must declare a non-empty \\`field\\``,\n        )\n      }\n      if (isCollect) {\n        if (typeof l.collect !== 'string' || l.collect.length === 0) {\n          throw new MaterializedViewConfigError(\n            `withMaterializedView \"${spec.name}\": a collect projection leg must declare a non-empty \\`collect\\` collection name`,\n          )\n        }\n        if (typeof l.on !== 'string' || l.on.length === 0) {\n          throw new MaterializedViewConfigError(\n            `withMaterializedView \"${spec.name}\": collect leg for \"${l.collect}\" must declare a non-empty \\`on\\` FK field`,\n          )\n        }\n      }\n      if (typeof l.as !== 'string' || l.as.length === 0) {\n        throw new MaterializedViewConfigError(\n          `withMaterializedView \"${spec.name}\": each projection leg must declare a non-empty \\`as\\` alias`,\n        )\n      }\n      if (seenAs.has(l.as)) {\n        throw new MaterializedViewConfigError(\n          `withMaterializedView \"${spec.name}\": projection legs must attach under distinct \\`as\\` aliases (duplicate: \"${l.as}\")`,\n        )\n      }\n      seenAs.add(l.as)\n    }\n    // Post-map grouping invariants — same rules as UNION (the mapped\n    // stream feeds the same shared groupAndReduce tail).\n    if (Array.isArray(spec.groupBy) && spec.groupBy.length === 0) {\n      throw new MaterializedViewConfigError(\n        `withMaterializedView \"${spec.name}\": groupBy must not be an empty array — omit it or provide at least one field name`,\n      )\n    }\n    if (spec.aggregate && !spec.groupBy) {\n      throw new MaterializedViewConfigError(\n        `withMaterializedView \"${spec.name}\": projection strategy with aggregate requires groupBy — `\n        + `use groupBy to declare the bucketing keys, or remove aggregate for a row-per-primary-record MV`,\n      )\n    }\n    if (spec.moneyFields && !spec.aggregate) {\n      throw new MaterializedViewConfigError(\n        `withMaterializedView \"${spec.name}\": moneyFields requires aggregate — `\n        + `moneyFields rewrites sum/min/max reducers over money output fields, `\n        + `so it is meaningless without an aggregate spec`,\n      )\n    }\n    if (spec.predicates) {\n      throw new MaterializedViewConfigError(\n        `withMaterializedView \"${spec.name}\": predicates are not supported on projection strategies — `\n        + `projection mode does not use a Query<T> chain, so .wherePredicate() cannot fire. `\n        + `Filter inside projection.map (return null to omit) instead`,\n      )\n    }\n  }\n  // i18nLocale + i18nFields drive compute-time i18n resolution of group-key\n  // i18nText fields before bucketing — UNION mode (resolved on the unified rows)\n  // AND query mode (resolved in GroupedReduction.run before groupAndReduce).\n  // i18nLocale without i18nFields cannot resolve anything, so reject it early.\n  if (spec.i18nLocale !== undefined && spec.i18nFields === undefined) {\n    throw new MaterializedViewConfigError(\n      `withMaterializedView \"${spec.name}\": i18nLocale requires i18nFields — `\n      + `declare the i18nText descriptors of the group-key fields so they can be `\n      + `resolved at the mv layer before bucketing.`,\n    )\n  }\n  if (typeof spec.rowKey !== 'function') {\n    throw new ValidationError('withMaterializedView: rowKey is required (no default; see spec § Type surface)')\n  }\n  if (spec.refresh !== 'eager' && spec.refresh !== 'lazy' && spec.refresh !== 'manual') {\n    throw new ValidationError(\n      `withMaterializedView: refresh must be 'eager' | 'lazy' | 'manual', got \"${String(spec.refresh)}\"`,\n    )\n  }\n  return {\n    __noydb_strategy: 'materialized-view',\n    spec,\n  }\n}\n"],"mappings":";;;;;;AA6BO,SAAS,qBACd,MAC0B;AAC1B,MAAI,CAAC,KAAK,QAAQ,KAAK,KAAK,WAAW,GAAG;AACxC,UAAM,IAAI,gBAAgB,wCAAwC;AAAA,EACpE;AAEA,QAAM,gBAAgB,CAAC,KAAK,OAAO,KAAK,cAAc,KAAK,UAAU,EAClE,OAAO,CAAC,MAAM,MAAM,MAAS,EAAE;AAClC,MAAI,gBAAgB,GAAG;AACrB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,kBAAkB,GAAG;AACvB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,MAAI,KAAK,UAAU,UAAa,OAAO,KAAK,UAAU,YAAY;AAChE,UAAM,IAAI,gBAAgB,qEAAqE;AAAA,EACjG;AAEA,MAAI,KAAK,cAAc;AAKrB,QAAI,KAAK,aAAa,SAAS,GAAG;AAChC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,OAAO,oBAAI,IAAY;AAC7B,eAAW,KAAK,KAAK,cAAc;AACjC,UAAI,OAAO,GAAG,eAAe,YAAY,EAAE,WAAW,WAAW,GAAG;AAClE,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AAAA,MACF;AACA,UAAI,OAAO,EAAE,QAAQ,YAAY;AAC/B,cAAM,IAAI;AAAA,UACR,2BAA2B,EAAE,UAAU;AAAA,QACzC;AAAA,MACF;AACA,UAAI,KAAK,IAAI,EAAE,UAAU,GAAG;AAC1B,cAAM,IAAI;AAAA,UACR,iEAAiE,EAAE,UAAU;AAAA,QAC/E;AAAA,MACF;AACA,WAAK,IAAI,EAAE,UAAU;AAAA,IACvB;AACA,QAAI,MAAM,QAAQ,KAAK,OAAO,KAAK,KAAK,QAAQ,WAAW,GAAG;AAC5D,YAAM,IAAI;AAAA,QACR,yBAAyB,KAAK,IAAI;AAAA,MACpC;AAAA,IACF;AACA,QAAI,KAAK,aAAa,CAAC,KAAK,SAAS;AACnC,YAAM,IAAI;AAAA,QACR,yBAAyB,KAAK,IAAI;AAAA,MAEpC;AAAA,IACF;AAIA,QAAI,KAAK,eAAe,CAAC,KAAK,WAAW;AACvC,YAAM,IAAI;AAAA,QACR,yBAAyB,KAAK,IAAI;AAAA,MAGpC;AAAA,IACF;AAKA,QAAI,KAAK,aAAa,KAAK,OAAK,EAAE,QAAQ,EAAE,KAAK,SAAS,CAAC,MAAM,CAAC,KAAK,WAAW,KAAK,QAAQ,WAAW,IAAI;AAC5G,YAAM,IAAI;AAAA,QACR,yBAAyB,KAAK,IAAI;AAAA,MAGpC;AAAA,IACF;AACA,QAAI,KAAK,YAAY;AACnB,YAAM,IAAI;AAAA,QACR,yBAAyB,KAAK,IAAI;AAAA,MAGpC;AAAA,IACF;AAAA,EACF;AAKA,MAAI,KAAK,YAAY;AACnB,UAAM,aAAa,KAAK;AACxB,QAAI,OAAO,WAAW,WAAW,YAAY,WAAW,OAAO,WAAW,GAAG;AAC3E,YAAM,IAAI;AAAA,QACR,yBAAyB,KAAK,IAAI;AAAA,MACpC;AAAA,IACF;AACA,QAAI,OAAO,WAAW,QAAQ,YAAY;AACxC,YAAM,IAAI;AAAA,QACR,yBAAyB,KAAK,IAAI;AAAA,MACpC;AAAA,IACF;AACA,QAAI,CAAC,MAAM,QAAQ,WAAW,KAAK,KAAK,WAAW,MAAM,SAAS,GAAG;AACnE,YAAM,IAAI;AAAA,QACR,yBAAyB,KAAK,IAAI;AAAA,MAEpC;AAAA,IACF;AACA,UAAM,SAAS,oBAAI,IAAY;AAC/B,eAAW,OAAO,WAAW,OAAO;AAClC,YAAM,IAAI;AACV,YAAM,YAAY,EAAE,UAAU;AAC9B,YAAM,YAAY,EAAE,YAAY;AAChC,UAAI,aAAa,WAAW;AAC1B,cAAM,IAAI;AAAA,UACR,yBAAyB,KAAK,IAAI;AAAA,QAEpC;AAAA,MACF;AACA,UAAI,CAAC,aAAa,CAAC,WAAW;AAC5B,cAAM,IAAI;AAAA,UACR,yBAAyB,KAAK,IAAI;AAAA,QAEpC;AAAA,MACF;AACA,UAAI,cAAc,OAAO,EAAE,UAAU,YAAY,EAAE,MAAM,WAAW,IAAI;AACtE,cAAM,IAAI;AAAA,UACR,yBAAyB,KAAK,IAAI;AAAA,QACpC;AAAA,MACF;AACA,UAAI,WAAW;AACb,YAAI,OAAO,EAAE,YAAY,YAAY,EAAE,QAAQ,WAAW,GAAG;AAC3D,gBAAM,IAAI;AAAA,YACR,yBAAyB,KAAK,IAAI;AAAA,UACpC;AAAA,QACF;AACA,YAAI,OAAO,EAAE,OAAO,YAAY,EAAE,GAAG,WAAW,GAAG;AACjD,gBAAM,IAAI;AAAA,YACR,yBAAyB,KAAK,IAAI,uBAAuB,EAAE,OAAO;AAAA,UACpE;AAAA,QACF;AAAA,MACF;AACA,UAAI,OAAO,EAAE,OAAO,YAAY,EAAE,GAAG,WAAW,GAAG;AACjD,cAAM,IAAI;AAAA,UACR,yBAAyB,KAAK,IAAI;AAAA,QACpC;AAAA,MACF;AACA,UAAI,OAAO,IAAI,EAAE,EAAE,GAAG;AACpB,cAAM,IAAI;AAAA,UACR,yBAAyB,KAAK,IAAI,6EAA6E,EAAE,EAAE;AAAA,QACrH;AAAA,MACF;AACA,aAAO,IAAI,EAAE,EAAE;AAAA,IACjB;AAGA,QAAI,MAAM,QAAQ,KAAK,OAAO,KAAK,KAAK,QAAQ,WAAW,GAAG;AAC5D,YAAM,IAAI;AAAA,QACR,yBAAyB,KAAK,IAAI;AAAA,MACpC;AAAA,IACF;AACA,QAAI,KAAK,aAAa,CAAC,KAAK,SAAS;AACnC,YAAM,IAAI;AAAA,QACR,yBAAyB,KAAK,IAAI;AAAA,MAEpC;AAAA,IACF;AACA,QAAI,KAAK,eAAe,CAAC,KAAK,WAAW;AACvC,YAAM,IAAI;AAAA,QACR,yBAAyB,KAAK,IAAI;AAAA,MAGpC;AAAA,IACF;AACA,QAAI,KAAK,YAAY;AACnB,YAAM,IAAI;AAAA,QACR,yBAAyB,KAAK,IAAI;AAAA,MAGpC;AAAA,IACF;AAAA,EACF;AAKA,MAAI,KAAK,eAAe,UAAa,KAAK,eAAe,QAAW;AAClE,UAAM,IAAI;AAAA,MACR,yBAAyB,KAAK,IAAI;AAAA,IAGpC;AAAA,EACF;AACA,MAAI,OAAO,KAAK,WAAW,YAAY;AACrC,UAAM,IAAI,gBAAgB,mFAAgF;AAAA,EAC5G;AACA,MAAI,KAAK,YAAY,WAAW,KAAK,YAAY,UAAU,KAAK,YAAY,UAAU;AACpF,UAAM,IAAI;AAAA,MACR,2EAA2E,OAAO,KAAK,OAAO,CAAC;AAAA,IACjG;AAAA,EACF;AACA,SAAO;AAAA,IACL,kBAAkB;AAAA,IAClB;AAAA,EACF;AACF;","names":[]}

package/dist/chunk-E6427JU2.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/kernel/query/join.ts"],"sourcesContent":["/**\n * Query DSL `.join()` — eager, single-FK, intra-vault joins.\n *\n * resolves a ref()-declared foreign key into an attached\n * right-side record under an alias, using one of two planner paths\n * selected automatically:\n *\n *   - **nested-loop** — right-side source exposes `lookupById`, so\n *     each left row costs O(1). This is the common path for joins\n *     against a Collection, which backs `lookupById` with a Map\n *     lookup.\n *   - **hash** — right-side has only `snapshot()`. Build a\n *     `Map<id, record>` once, probe per left row. Same asymptotic\n *     cost for our collections, but the path exists as a fallback\n *     for custom QuerySource implementations and as an explicit\n *     test-only override via `{ strategy: 'hash' }`.\n *\n * Scope:\n *\n *   - Equi-joins on declared `ref()` fields only. Joins on\n *     undeclared fields throw at plan time with an actionable error\n *     naming the field and collection.\n *   - Same-vault only. Cross-vault correlation goes\n *     through `queryAcross`; this is an architectural\n *     invariant, not a limitation we plan to lift.\n *   - Hard row ceiling via `JoinTooLargeError` — default 50k per\n *     side, override via `{ maxRows }`. Warns at 80% of the ceiling\n *     on the existing warn channel.\n *   - Three ref-mode behaviors on dangling refs:\n *     strict → `DanglingReferenceError`,\n *     warn → attach `null` with a one-shot warning,\n *     cascade → attach `null` silently (cascade is a delete-time\n *     mode; any dangling refs still present at read time are\n *     mid-flight cascades or orphans from earlier, not a DSL error).\n *\n * Partition-awareness seam:\n *\n * Every `JoinLeg` carries a `partitionScope` field that is always\n * `'all'` in. The executor never reads this field.\n * partition-aware joins will start populating it from `where()`\n * predicates on the partition key without changing the planner's\n * external shape — this is the whole reason it exists now.\n *\n * Joins stay OUT of the ledger: reads don't touch `_ledger/`,\n * including joined reads.\n */\n\nimport type { RefDescriptor, RefMode } from '../refs.js'\nimport { readPath } from './predicate.js'\nimport { JoinTooLargeError, DanglingReferenceError } from '../errors.js'\n\n/** Planner strategy for a single join leg. Auto-selected unless overridden. */\nexport type JoinStrategy = 'hash' | 'nested'\n\n/** Default per-side row ceiling before `.join()` throws `JoinTooLargeError`. */\nexport const DEFAULT_JOIN_MAX_ROWS = 50_000\n\n/**\n * Fraction of the row ceiling at which a one-shot warning is emitted.\n * At 80% we warn; at 100% we throw. The warn gives consumers a\n * heads-up before the hard error so they can raise the ceiling or\n * filter further without first hitting a broken query.\n */\nconst JOIN_WARN_FRACTION = 0.8\n\n/**\n * Internal representation of a single join leg in the query plan.\n *\n * This is the primary place where  constraint #1 is honored:\n * every leg carries a `partitionScope` field that is always `'all'`\n * in and is never read by the executor. partition-aware\n * joins will start populating it from `where()` predicates on the\n * partition key without changing the planner's external shape.\n */\nexport interface JoinLeg {\n  /** Field on the left-side record holding the foreign key value. */\n  readonly field: string\n  /** Alias key under which the joined right-side record attaches. */\n  readonly as: string\n  /** Target collection name, resolved from the `ref()` declaration. */\n  readonly target: string\n  /** Ref mode controlling behavior on dangling refs at read time. */\n  readonly mode: RefMode\n  /** Manual planner strategy override. `undefined` → auto-select. */\n  readonly strategy: JoinStrategy | undefined\n  /** Per-side row ceiling override. `undefined` → DEFAULT_JOIN_MAX_ROWS. */\n  readonly maxRows: number | undefined\n  /**\n   * Partition scope for future partition-aware joins. Always `'all'`\n   * today — the executor never reads this field. Future versions will\n   * populate it from `where()` predicates without breaking the\n   * planner's external shape. Do not remove even though it looks\n   * unused today — that's the whole point of having it.\n   */\n  readonly partitionScope: 'all' | readonly string[]\n  /**\n   * When `true`, this is a dictionary join. The executor\n   * resolves the left-field value against the dict snapshot and\n   * attaches `{ ...labels, key }` rather than a right-side record.\n   * `target` holds the dictionary name (not a collection name).\n   */\n  readonly isDictJoin?: true\n}\n\n/**\n * Minimal shape of a joinable right-side record source.\n *\n * Collections implement this structurally via their `QuerySource`;\n * sources without `lookupById` force the hash-join fallback. Kept as\n * a thin interface so tests can wire up plain-object sources without\n * pulling in the full Collection class.\n *\n * The optional `subscribe` is used by `Query.live()` to merge\n * right-side change streams into the live re-run trigger. Sources\n * that omit `subscribe` still work for live joins — they just\n * don't drive re-fires when their right side mutates. Collection\n * implements `subscribe` by hooking into the existing per-\n * vault event emitter.\n */\nexport interface JoinableSource {\n  snapshot(): readonly unknown[]\n  lookupById?(id: string): unknown\n  /**\n   * Default locale a label-resolving query falls back to when the query\n   * itself is locale-less. Set by a `staticDict()`-backed source from its\n   * `displayLocale` so `{ by: 'label' }` resolves under a locale-less read.\n   * Plain `_dict_*`-backed sources omit it.\n   */\n  readonly displayLocale?: string\n  /**\n   * Sync present-for-join dressing (#626 retirement, #650 Task 6) — when\n   * present and the query carries a locale, each joined right-side record\n   * is passed through this hook (built by the right-side `Collection` from\n   * its own i18n-text + lookup-label bindings) BEFORE it is attached under\n   * the leg's alias — so a joined `i18nText` field resolves to a string\n   * (not a raw `{ locale }` map) and a joined lookup field gains its\n   * `<field>Label`. Locale-less queries leave joined fields raw\n   * (consistent with a locale-less read). Replaces the old `i18nFields`\n   * data field — the join executor no longer resolves i18n locale itself,\n   * it just calls this hook.\n   */\n  readonly presentForJoin?: (record: unknown, locale: string) => unknown\n  /**\n   * Subscribe to mutations on this source. The callback fires\n   * AFTER the underlying record set has been updated. Returns an\n   * unsubscribe function. Optional — sources without this method\n   * cannot trigger live-join re-fires from their side.\n   */\n  subscribe?(cb: () => void): () => void\n}\n\n/**\n * Join resolution context attached to a `Query` when it's constructed\n * from a `Collection`. Holds everything the `.join()` method needs to\n * translate a field name into a target collection + ref mode, and\n * everything the executor needs to read the right side.\n *\n * Kept as a structural interface so `Vault` can implement it\n * without `Query` needing to import `Vault` (circular-import\n * avoid). The Collection wires this up in its `query()` method using\n * the `joinResolver` back-reference the Vault passes in.\n */\nexport interface JoinContext {\n  /** Name of the left-side (owning) collection. */\n  readonly leftCollection: string\n  /**\n   * The owning collection's default locale. Used to resolve joined\n   * i18n fields at the `join` layer when a terminal call doesn't pass an\n   * explicit locale — so `openVault({ locale })` flows to joins like it does\n   * to `get`/`list`. A per-call `toArray({ locale })` overrides it.\n   */\n  readonly defaultLocale?: string\n  /** Look up a `RefDescriptor` by field name on the left collection. */\n  resolveRef(field: string): RefDescriptor | null\n  /** Resolve a right-side source by target collection name. */\n  resolveSource(collectionName: string): JoinableSource | null\n  /**\n   * Resolve a dictKey join source. Returns a `JoinableSource`\n   * whose snapshot exposes `{ key, ...labels }` records, keyed by the\n   * stable dictionary key. `null` when the field is not a dictKey.\n   *\n   * The source is built from the compartment's in-memory dictionary\n   * snapshot — same data as `DictionaryHandle.list()`, O(1) per lookup.\n   */\n  resolveDictSource?(field: string): JoinableSource | null\n}\n\n/**\n * Coerce an unknown FK value into a lookup key string.\n *\n * Legitimate ref values are strings or numbers — the same narrowing\n * the write-time `enforceRefsOnPut` path applies. Anything else\n * (objects, arrays, booleans, null, undefined) is treated as \"no\n * ref\" and returns `null`, so the join attaches `null` instead of\n * running `String({})` and producing `'[object Object]'` as a\n * bucket key. This matches the lint rule guidance and keeps\n * bizarre FK values from producing silently-wrong lookups.\n */\nfunction coerceRefKey(value: unknown): string | null {\n  if (value === null || value === undefined) return null\n  if (typeof value === 'string') return value\n  if (typeof value === 'number' || typeof value === 'bigint') return String(value)\n  return null\n}\n\n/**\n * Warn-channel deduplication for dangling-ref `'warn'` mode. Keyed\n * by `field → target:refId` so the same dangling ref only produces\n * one warning even across many rows or repeated queries.\n */\nconst warnedDanglingKeys = new Set<string>()\nfunction warnOnceDangling(field: string, target: string, refId: string): void {\n  const key = `${field}→${target}:${refId}`\n  if (warnedDanglingKeys.has(key)) return\n  warnedDanglingKeys.add(key)\n  console.warn(\n    `[noy-db] .join() encountered dangling ref in 'warn' mode: ` +\n      `field \"${field}\" → \"${target}:${refId}\" not found. Attaching null.`,\n  )\n}\n\n/**\n * Track row-ceiling warnings to fire only once per (target, side).\n * Prevents per-query spam when a consumer is running the same query\n * repeatedly (e.g. in a reactive loop).\n */\nconst warnedCeilingKeys = new Set<string>()\nfunction warnCeilingApproaching(\n  target: string,\n  side: 'left' | 'right',\n  rows: number,\n  maxRows: number,\n): void {\n  const key = `${target}:${side}`\n  if (warnedCeilingKeys.has(key)) return\n  warnedCeilingKeys.add(key)\n  const pct = Math.round((rows / maxRows) * 100)\n  console.warn(\n    `[noy-db] .join() ${side} side is at ${pct}% of the ${maxRows}-row ` +\n      `ceiling for target \"${target}\" (${rows} rows). Streaming joins over ` +\n      `scan() are not yet supported for collections that need to exceed this.`,\n  )\n}\n\n/**\n * Apply every join leg in the plan against a base set of left-side\n * rows. Called by the query executor after `where` / `orderBy` /\n * `offset` / `limit` have narrowed the left set.\n *\n * Each leg attaches a `leg.as` field to every row. Returns a new\n * array of plain objects — the original left rows are not mutated\n * (structural sharing is fine for the inner fields, but the\n * top-level object is a fresh clone so consumers can further mutate\n * safely).\n *\n * **Ordering:** joins run AFTER orderBy / limit / offset in v1.\n * This keeps the planner simple and means queries like \"top 10\n * invoices with client\" sort and paginate the left side first, then\n * join. Sorting *by* a joined field is out of scope for  — users\n * can post-sort the result array in userland or wait for \n * (multi-FK chaining) which can be layered on top.\n *\n * **Multi-FK chaining:** each leg's `maxRows` is enforced\n * against the current left-row count independently. Because\n * joins are equi-joins on the target's primary key (one-to-one or\n * one-to-null), the left row count is constant across legs — no\n * cartesian blowup. The per-leg left-side check is still necessary\n * so that a later leg with a tighter ceiling correctly fires on a\n * query like `.join('a', { maxRows: 100_000 }).join('b', { maxRows: 50 })`,\n * which should throw on the second leg if the left set exceeds 50.\n */\nexport function applyJoins(\n  rows: readonly unknown[],\n  joins: readonly JoinLeg[],\n  context: JoinContext,\n  locale?: string,\n): unknown[] {\n  if (joins.length === 0) return [...rows]\n\n  let result: unknown[] = [...rows]\n  for (const leg of joins) {\n    result = applyOneJoin(result, leg, context, locale)\n  }\n  return result\n}\n\nfunction applyOneJoin(\n  leftRows: readonly unknown[],\n  leg: JoinLeg,\n  context: JoinContext,\n  locale?: string,\n): unknown[] {\n  // Dict join path — resolve left-field value against the\n  // dictionary snapshot and attach { key, ...labels } under leg.as.\n  if (leg.isDictJoin) {\n    const dictSource = context.resolveDictSource?.(leg.field)\n    if (!dictSource) {\n      throw new Error(\n        `.join() field \"${leg.field}\" on \"${context.leftCollection}\" is declared as a ` +\n          `dictKey join but the dict source could not be resolved. ` +\n          `Ensure the dictionary has at least one entry.`,\n      )\n    }\n    const out: unknown[] = []\n    const snapshot = dictSource.snapshot()\n    const dictMap = new Map<string, unknown>()\n    for (const entry of snapshot) {\n      const k = readPath(entry, 'key')\n      if (typeof k === 'string') dictMap.set(k, entry)\n    }\n    for (const left of leftRows) {\n      const rawId = readPath(left, leg.field)\n      const key = coerceRefKey(rawId)\n      const dictEntry = key === null ? undefined : dictMap.get(key)\n      out.push({ ...(left as Record<string, unknown>), [leg.as]: dictEntry ?? null })\n    }\n    return out\n  }\n\n  const source = context.resolveSource(leg.target)\n  if (!source) {\n    throw new Error(\n      `.join() cannot resolve target collection \"${leg.target}\" ` +\n        `(referenced from field \"${leg.field}\" on \"${context.leftCollection}\"). ` +\n        `Make sure the target collection has been opened via vault.collection() ` +\n        `at least once before running the query.`,\n    )\n  }\n\n  const maxRows = leg.maxRows ?? DEFAULT_JOIN_MAX_ROWS\n\n  // Per-leg left-side ceiling check. In a\n  // multi-FK chain, each leg's `maxRows` is enforced independently\n  // against the current left-row count, so\n  // `.join('a', { maxRows: 100_000 }).join('b', { maxRows: 50 })`\n  // correctly throws on the second leg if the left set exceeds 50.\n  if (leftRows.length > maxRows) {\n    throw new JoinTooLargeError({\n      leftRows: leftRows.length,\n      rightRows: -1,\n      maxRows,\n      side: 'left',\n      message:\n        `.join() left side has ${leftRows.length} rows, exceeding the ${maxRows}-row ` +\n        `ceiling for target \"${leg.target}\". Filter the left side further with ` +\n        `where()/limit() before joining, or raise the ceiling via { maxRows }. ` +\n        `Streaming joins over scan() are not yet supported.`,\n    })\n  }\n  if (leftRows.length > maxRows * JOIN_WARN_FRACTION) {\n    warnCeilingApproaching(leg.target, 'left', leftRows.length, maxRows)\n  }\n\n  const rightSnapshot = source.snapshot()\n  if (rightSnapshot.length > maxRows) {\n    throw new JoinTooLargeError({\n      leftRows: leftRows.length,\n      rightRows: rightSnapshot.length,\n      maxRows,\n      side: 'right',\n      message:\n        `.join() right side \"${leg.target}\" has ${rightSnapshot.length} rows, ` +\n        `exceeding the ${maxRows}-row ceiling. Raise the ceiling via { maxRows } ` +\n        `if the data genuinely fits in memory, or track  for streaming joins.`,\n    })\n  }\n  if (rightSnapshot.length > maxRows * JOIN_WARN_FRACTION) {\n    warnCeilingApproaching(leg.target, 'right', rightSnapshot.length, maxRows)\n  }\n\n  // `join`-layer dressing (#650 Task 6, #626 retirement). When the query\n  // carries a locale (per-call or the owning collection's default) and the\n  // right side declares a `presentForJoin` hook, resolve each matched right\n  // record through it before it's attached. Locale-less → leave raw.\n  const effLocale = locale ?? context.defaultLocale\n  const presentResolve: ((right: unknown) => unknown) | undefined =\n    effLocale !== undefined && source.presentForJoin !== undefined\n      ? (right) =>\n          right !== null && typeof right === 'object'\n            ? source.presentForJoin!(right, effLocale)\n            : right\n      : undefined\n\n  // Strategy selection: explicit override wins; otherwise prefer\n  // nested-loop when the source exposes lookupById (O(1) per row),\n  // falling back to hash join when it doesn't.\n  const strategy: JoinStrategy =\n    leg.strategy ?? (source.lookupById ? 'nested' : 'hash')\n\n  if (strategy === 'nested' && source.lookupById) {\n    // Bind through an arrow so the `this` context of lookupById\n    // doesn't drift — same pattern as the existing candidateRecords\n    // helper in builder.ts.\n    const lookup = (id: string): unknown => source.lookupById?.(id)\n    return nestedLoopJoin(leftRows, leg, lookup, presentResolve)\n  }\n  return hashJoin(leftRows, leg, rightSnapshot, presentResolve)\n}\n\nfunction nestedLoopJoin(\n  leftRows: readonly unknown[],\n  leg: JoinLeg,\n  lookupById: (id: string) => unknown,\n  presentResolve?: (right: unknown) => unknown,\n): unknown[] {\n  const out: unknown[] = []\n  for (const left of leftRows) {\n    const rawId = readPath(left, leg.field)\n    const key = coerceRefKey(rawId)\n    let right = key === null ? undefined : lookupById(key)\n    if (presentResolve && right !== undefined) right = presentResolve(right)\n    out.push(attachJoin(left, leg, right, rawId))\n  }\n  return out\n}\n\nfunction hashJoin(\n  leftRows: readonly unknown[],\n  leg: JoinLeg,\n  rightSnapshot: readonly unknown[],\n  presentResolve?: (right: unknown) => unknown,\n): unknown[] {\n  // Build the right-side hash once per query execution. We key on\n  // the `id` field because ref() always points to a target's primary\n  // key — non-equi and non-id joins are out of scope for.\n  const rightMap = new Map<string, unknown>()\n  for (const record of rightSnapshot) {\n    const rawId = readPath(record, 'id')\n    const key = coerceRefKey(rawId)\n    if (key !== null) {\n      rightMap.set(key, record)\n    }\n  }\n  const out: unknown[] = []\n  for (const left of leftRows) {\n    const rawId = readPath(left, leg.field)\n    const key = coerceRefKey(rawId)\n    let right = key === null ? undefined : rightMap.get(key)\n    if (presentResolve && right !== undefined) right = presentResolve(right)\n    out.push(attachJoin(left, leg, right, rawId))\n  }\n  return out\n}\n\n/**\n * Attach the resolved right-side record (or null) to the left row\n * under the alias, applying ref-mode semantics for the dangling\n * case.\n *\n * A left-side record whose FK field is null/undefined is NOT a\n * dangling ref — it's \"no reference at all\", which is always\n * allowed regardless of mode. This matches the write-time\n * `enforceRefsOnPut` behavior: \"Nullish ref values are allowed —\n * treat them as 'no reference'.\"\n *\n * Only non-null FKs pointing at non-existent targets trigger the\n * mode behavior.\n */\nfunction attachJoin(\n  left: unknown,\n  leg: JoinLeg,\n  right: unknown,\n  rawId: unknown,\n): unknown {\n  if (left === null || typeof left !== 'object') {\n    // Pathological input — return as-is. Shouldn't happen in\n    // practice because QuerySource yields objects, but defensive\n    // because plan execution is untyped at this layer.\n    return left\n  }\n  const merged: Record<string, unknown> = { ...(left as Record<string, unknown>) }\n\n  // \"No ref at all\" — null/undefined FK value, or a non-string/non-\n  // number FK that coerceRefKey treated as no-ref. Never throws\n  // regardless of mode; matches the write-time policy that nullish\n  // refs are allowed.\n  const refKey = coerceRefKey(rawId)\n  if (right === undefined) {\n    if (refKey !== null && leg.mode === 'strict') {\n      throw new DanglingReferenceError({\n        field: leg.field,\n        target: leg.target,\n        refId: refKey,\n        message:\n          `.join() strict dangling: record references \"${leg.target}:${refKey}\" ` +\n          `via field \"${leg.field}\", but no such record exists. Use ref() mode 'warn' ` +\n          `or 'cascade' if dangling refs are acceptable, or run ` +\n          `vault.checkIntegrity() to find and fix the orphans.`,\n      })\n    }\n    if (refKey !== null && leg.mode === 'warn') {\n      warnOnceDangling(leg.field, leg.target, refKey)\n    }\n    // For 'cascade' and null refs we attach null silently. Cascade\n    // is a delete-time mode; any dangling refs visible at read time\n    // are either mid-flight or pre-existing orphans, not a DSL error.\n    merged[leg.as] = null\n  } else {\n    merged[leg.as] = right\n  }\n  return merged\n}\n\n/**\n * Test-only: reset the join warning deduplication state between\n * tests. Production code never calls this — the dedup state is\n * intentionally process-scoped so a noisy query doesn't spam the\n * console once per component render.\n */\nexport function resetJoinWarnings(): void {\n  warnedDanglingKeys.clear()\n  warnedCeilingKeys.clear()\n}\n"],"mappings":";;;;;;;;;AAuDO,IAAM,wBAAwB;AAQrC,IAAM,qBAAqB;AAuI3B,SAAS,aAAa,OAA+B;AACnD,MAAI,UAAU,QAAQ,UAAU,OAAW,QAAO;AAClD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,SAAU,QAAO,OAAO,KAAK;AAC/E,SAAO;AACT;AAOA,IAAM,qBAAqB,oBAAI,IAAY;AAC3C,SAAS,iBAAiB,OAAe,QAAgB,OAAqB;AAC5E,QAAM,MAAM,GAAG,KAAK,SAAI,MAAM,IAAI,KAAK;AACvC,MAAI,mBAAmB,IAAI,GAAG,EAAG;AACjC,qBAAmB,IAAI,GAAG;AAC1B,UAAQ;AAAA,IACN,oEACY,KAAK,aAAQ,MAAM,IAAI,KAAK;AAAA,EAC1C;AACF;AAOA,IAAM,oBAAoB,oBAAI,IAAY;AAC1C,SAAS,uBACP,QACA,MACA,MACA,SACM;AACN,QAAM,MAAM,GAAG,MAAM,IAAI,IAAI;AAC7B,MAAI,kBAAkB,IAAI,GAAG,EAAG;AAChC,oBAAkB,IAAI,GAAG;AACzB,QAAM,MAAM,KAAK,MAAO,OAAO,UAAW,GAAG;AAC7C,UAAQ;AAAA,IACN,oBAAoB,IAAI,eAAe,GAAG,YAAY,OAAO,4BACpC,MAAM,MAAM,IAAI;AAAA,EAE3C;AACF;AA6BO,SAAS,WACd,MACA,OACA,SACA,QACW;AACX,MAAI,MAAM,WAAW,EAAG,QAAO,CAAC,GAAG,IAAI;AAEvC,MAAI,SAAoB,CAAC,GAAG,IAAI;AAChC,aAAW,OAAO,OAAO;AACvB,aAAS,aAAa,QAAQ,KAAK,SAAS,MAAM;AAAA,EACpD;AACA,SAAO;AACT;AAEA,SAAS,aACP,UACA,KACA,SACA,QACW;AAGX,MAAI,IAAI,YAAY;AAClB,UAAM,aAAa,QAAQ,oBAAoB,IAAI,KAAK;AACxD,QAAI,CAAC,YAAY;AACf,YAAM,IAAI;AAAA,QACR,kBAAkB,IAAI,KAAK,SAAS,QAAQ,cAAc;AAAA,MAG5D;AAAA,IACF;AACA,UAAM,MAAiB,CAAC;AACxB,UAAM,WAAW,WAAW,SAAS;AACrC,UAAM,UAAU,oBAAI,IAAqB;AACzC,eAAW,SAAS,UAAU;AAC5B,YAAM,IAAI,SAAS,OAAO,KAAK;AAC/B,UAAI,OAAO,MAAM,SAAU,SAAQ,IAAI,GAAG,KAAK;AAAA,IACjD;AACA,eAAW,QAAQ,UAAU;AAC3B,YAAM,QAAQ,SAAS,MAAM,IAAI,KAAK;AACtC,YAAM,MAAM,aAAa,KAAK;AAC9B,YAAM,YAAY,QAAQ,OAAO,SAAY,QAAQ,IAAI,GAAG;AAC5D,UAAI,KAAK,EAAE,GAAI,MAAkC,CAAC,IAAI,EAAE,GAAG,aAAa,KAAK,CAAC;AAAA,IAChF;AACA,WAAO;AAAA,EACT;AAEA,QAAM,SAAS,QAAQ,cAAc,IAAI,MAAM;AAC/C,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI;AAAA,MACR,6CAA6C,IAAI,MAAM,6BAC1B,IAAI,KAAK,SAAS,QAAQ,cAAc;AAAA,IAGvE;AAAA,EACF;AAEA,QAAM,UAAU,IAAI,WAAW;AAO/B,MAAI,SAAS,SAAS,SAAS;AAC7B,UAAM,IAAI,kBAAkB;AAAA,MAC1B,UAAU,SAAS;AAAA,MACnB,WAAW;AAAA,MACX;AAAA,MACA,MAAM;AAAA,MACN,SACE,yBAAyB,SAAS,MAAM,wBAAwB,OAAO,4BAChD,IAAI,MAAM;AAAA,IAGrC,CAAC;AAAA,EACH;AACA,MAAI,SAAS,SAAS,UAAU,oBAAoB;AAClD,2BAAuB,IAAI,QAAQ,QAAQ,SAAS,QAAQ,OAAO;AAAA,EACrE;AAEA,QAAM,gBAAgB,OAAO,SAAS;AACtC,MAAI,cAAc,SAAS,SAAS;AAClC,UAAM,IAAI,kBAAkB;AAAA,MAC1B,UAAU,SAAS;AAAA,MACnB,WAAW,cAAc;AAAA,MACzB;AAAA,MACA,MAAM;AAAA,MACN,SACE,uBAAuB,IAAI,MAAM,SAAS,cAAc,MAAM,wBAC7C,OAAO;AAAA,IAE5B,CAAC;AAAA,EACH;AACA,MAAI,cAAc,SAAS,UAAU,oBAAoB;AACvD,2BAAuB,IAAI,QAAQ,SAAS,cAAc,QAAQ,OAAO;AAAA,EAC3E;AAMA,QAAM,YAAY,UAAU,QAAQ;AACpC,QAAM,iBACJ,cAAc,UAAa,OAAO,mBAAmB,SACjD,CAAC,UACC,UAAU,QAAQ,OAAO,UAAU,WAC/B,OAAO,eAAgB,OAAO,SAAS,IACvC,QACN;AAKN,QAAM,WACJ,IAAI,aAAa,OAAO,aAAa,WAAW;AAElD,MAAI,aAAa,YAAY,OAAO,YAAY;AAI9C,UAAM,SAAS,CAAC,OAAwB,OAAO,aAAa,EAAE;AAC9D,WAAO,eAAe,UAAU,KAAK,QAAQ,cAAc;AAAA,EAC7D;AACA,SAAO,SAAS,UAAU,KAAK,eAAe,cAAc;AAC9D;AAEA,SAAS,eACP,UACA,KACA,YACA,gBACW;AACX,QAAM,MAAiB,CAAC;AACxB,aAAW,QAAQ,UAAU;AAC3B,UAAM,QAAQ,SAAS,MAAM,IAAI,KAAK;AACtC,UAAM,MAAM,aAAa,KAAK;AAC9B,QAAI,QAAQ,QAAQ,OAAO,SAAY,WAAW,GAAG;AACrD,QAAI,kBAAkB,UAAU,OAAW,SAAQ,eAAe,KAAK;AACvE,QAAI,KAAK,WAAW,MAAM,KAAK,OAAO,KAAK,CAAC;AAAA,EAC9C;AACA,SAAO;AACT;AAEA,SAAS,SACP,UACA,KACA,eACA,gBACW;AAIX,QAAM,WAAW,oBAAI,IAAqB;AAC1C,aAAW,UAAU,eAAe;AAClC,UAAM,QAAQ,SAAS,QAAQ,IAAI;AACnC,UAAM,MAAM,aAAa,KAAK;AAC9B,QAAI,QAAQ,MAAM;AAChB,eAAS,IAAI,KAAK,MAAM;AAAA,IAC1B;AAAA,EACF;AACA,QAAM,MAAiB,CAAC;AACxB,aAAW,QAAQ,UAAU;AAC3B,UAAM,QAAQ,SAAS,MAAM,IAAI,KAAK;AACtC,UAAM,MAAM,aAAa,KAAK;AAC9B,QAAI,QAAQ,QAAQ,OAAO,SAAY,SAAS,IAAI,GAAG;AACvD,QAAI,kBAAkB,UAAU,OAAW,SAAQ,eAAe,KAAK;AACvE,QAAI,KAAK,WAAW,MAAM,KAAK,OAAO,KAAK,CAAC;AAAA,EAC9C;AACA,SAAO;AACT;AAgBA,SAAS,WACP,MACA,KACA,OACA,OACS;AACT,MAAI,SAAS,QAAQ,OAAO,SAAS,UAAU;AAI7C,WAAO;AAAA,EACT;AACA,QAAM,SAAkC,EAAE,GAAI,KAAiC;AAM/E,QAAM,SAAS,aAAa,KAAK;AACjC,MAAI,UAAU,QAAW;AACvB,QAAI,WAAW,QAAQ,IAAI,SAAS,UAAU;AAC5C,YAAM,IAAI,uBAAuB;AAAA,QAC/B,OAAO,IAAI;AAAA,QACX,QAAQ,IAAI;AAAA,QACZ,OAAO;AAAA,QACP,SACE,+CAA+C,IAAI,MAAM,IAAI,MAAM,gBACrD,IAAI,KAAK;AAAA,MAG3B,CAAC;AAAA,IACH;AACA,QAAI,WAAW,QAAQ,IAAI,SAAS,QAAQ;AAC1C,uBAAiB,IAAI,OAAO,IAAI,QAAQ,MAAM;AAAA,IAChD;AAIA,WAAO,IAAI,EAAE,IAAI;AAAA,EACnB,OAAO;AACL,WAAO,IAAI,EAAE,IAAI;AAAA,EACnB;AACA,SAAO;AACT;AAQO,SAAS,oBAA0B;AACxC,qBAAmB,MAAM;AACzB,oBAAkB,MAAM;AAC1B;","names":[]}

package/dist/chunk-FFDNKRCY.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-audit/portability/export-accessible.ts"],"sourcesContent":["/**\n * `exportMyAccessibleData`: a non-owner user exports the scope they\n * can decrypt as a portable, re-keyed `.noydb` bundle. Non-destructive and\n * **always allowed** (the \"data sovereignty by construction\" property of\n * sealing-at-dimension — the firm cannot deny it) but **audited**.\n *\n * Reuses the existing bundle machinery: the access boundary is the caller's DEK\n * set (operator/client → `keyring.permissions`; owner/admin/viewer → all), so a\n * record outside the caller's keys can never enter the bundle. Re-keying to a\n * new owner reuses `writePod`'s `exportSecret` shorthand.\n */\nimport type { Vault } from '../../kernel/vault.js'\nimport type { UnlockedKeyring } from '../../with-party/team/keyring.js'\nimport { writePod } from '../../with-pod/bundle.js'\n\n/**\n * Resolve the collections a caller may export/withdraw: operator/client are\n * scoped to their granted collections; owner/admin/viewer see everything\n * (`undefined` = no allowlist). A `scope.collections` sub-scope intersects the\n * granted set. `writableOnly` keeps only `rw` grants (for destructive ops).\n */\nexport function resolveAccessibleCollections(\n  keyring: UnlockedKeyring,\n  scope: { collections?: readonly string[] } | undefined,\n  writableOnly = false,\n): string[] | undefined {\n  let collections: string[] | undefined\n  if (keyring.role === 'operator' || keyring.role === 'client') {\n    collections = Object.entries(keyring.permissions)\n      .filter(([, mode]) => !writableOnly || mode === 'rw')\n      .map(([c]) => c)\n  }\n  if (scope?.collections) {\n    const allow = new Set(scope.collections)\n    collections = (collections ?? [...scope.collections]).filter((c) => allow.has(c))\n  }\n  return collections\n}\n\n/** Produce a (optionally re-keyed, scoped) `.noydb` bundle — no audit. */\nexport async function buildAccessibleBundle(\n  vault: Vault,\n  collections: string[] | undefined,\n  reKey: { secret: string } | undefined,\n  compression: 'auto' | 'brotli' | 'gzip' | 'none' = 'auto',\n): Promise<Uint8Array> {\n  return writePod(vault, {\n    compression,\n    ...(collections !== undefined ? { collections } : {}),\n    ...(reKey ? { exportSecret: reKey.secret } : {}),\n  })\n}\n\nexport interface ExportAccessibleOptions {\n  /**\n   * Re-key the bundle so it is independently openable by a new owner with this\n   * secret (the receiving firm / the client themselves). Omit to inherit\n   * the source keyring (personal backup).\n   */\n  readonly reKey?: { readonly secret: string }\n  /** Narrow the export to a subset of the caller's accessible collections. */\n  readonly scope?: { readonly collections?: readonly string[] }\n  readonly compression?: 'auto' | 'brotli' | 'gzip' | 'none'\n}\n\n/**\n * Produce a re-keyed, access-scoped `.noydb` bundle of the caller's accessible\n * data. Appends a tamper-evident audit entry (`reason: 'user-export:<userId>'`).\n */\nexport async function exportAccessibleData(\n  vault: Vault,\n  opts: ExportAccessibleOptions = {},\n): Promise<Uint8Array> {\n  const { keyring } = vault._introspectState()\n  const collections = resolveAccessibleCollections(keyring, opts.scope)\n  const bytes = await buildAccessibleBundle(vault, collections, opts.reKey, opts.compression ?? 'auto')\n\n  // §11.11 audit — non-destructive, always-allowed export. No-op when the vault\n  // has no history/ledger strategy (avoids minting a phantom _ledger DEK).\n  await vault._getLedgerOrNull()?.append({\n    op: 'lifecycle',\n    collection: '',\n    id: '',\n    version: 0,\n    actor: keyring.userId,\n    payloadHash: '',\n    reason: `user-export:${keyring.userId}`,\n  })\n\n  return bytes\n}\n"],"mappings":";;;;;AAqBO,SAAS,6BACd,SACA,OACA,eAAe,OACO;AACtB,MAAI;AACJ,MAAI,QAAQ,SAAS,cAAc,QAAQ,SAAS,UAAU;AAC5D,kBAAc,OAAO,QAAQ,QAAQ,WAAW,EAC7C,OAAO,CAAC,CAAC,EAAE,IAAI,MAAM,CAAC,gBAAgB,SAAS,IAAI,EACnD,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;AAAA,EACnB;AACA,MAAI,OAAO,aAAa;AACtB,UAAM,QAAQ,IAAI,IAAI,MAAM,WAAW;AACvC,mBAAe,eAAe,CAAC,GAAG,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,MAAM,IAAI,CAAC,CAAC;AAAA,EAClF;AACA,SAAO;AACT;AAGA,eAAsB,sBACpB,OACA,aACA,OACA,cAAmD,QAC9B;AACrB,SAAO,SAAS,OAAO;AAAA,IACrB;AAAA,IACA,GAAI,gBAAgB,SAAY,EAAE,YAAY,IAAI,CAAC;AAAA,IACnD,GAAI,QAAQ,EAAE,cAAc,MAAM,OAAO,IAAI,CAAC;AAAA,EAChD,CAAC;AACH;AAkBA,eAAsB,qBACpB,OACA,OAAgC,CAAC,GACZ;AACrB,QAAM,EAAE,QAAQ,IAAI,MAAM,iBAAiB;AAC3C,QAAM,cAAc,6BAA6B,SAAS,KAAK,KAAK;AACpE,QAAM,QAAQ,MAAM,sBAAsB,OAAO,aAAa,KAAK,OAAO,KAAK,eAAe,MAAM;AAIpG,QAAM,MAAM,iBAAiB,GAAG,OAAO;AAAA,IACrC,IAAI;AAAA,IACJ,YAAY;AAAA,IACZ,IAAI;AAAA,IACJ,SAAS;AAAA,IACT,OAAO,QAAQ;AAAA,IACf,aAAa;AAAA,IACb,QAAQ,eAAe,QAAQ,MAAM;AAAA,EACvC,CAAC;AAED,SAAO;AACT;","names":[]}

package/dist/chunk-FZ6NYJ7L.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/with-audit/portability/withdraw-accessible.ts"],"sourcesContent":["/**\n * `unilateralWithdrawal`: a non-owner extracts their accessible scope\n * AND disposes of the source copy. Destructive; gated by the default-off\n * fail-closed built-in `client-unilateral-withdraw` policy (checked in the\n * UserApi wrapper).\n *\n * Two source dispositions:\n *  - 'delete'  — delete-closure: the records leave the source vault entirely.\n *  - 'freeze'  — the firm retains a cryptographically-frozen, read-only, write-once\n *                snapshot (hash-pinned in the tamper-evident ledger) while the live\n *                records are removed.\n *\n * Ordering guarantees no data loss: the client's re-keyed export bundle (and the\n * freeze snapshot) are produced BEFORE anything is deleted.\n *\n * The `freezeAndDeleteClosure` core is shared with the two-party approval path\n * (`request-withdrawal.ts`).\n */\nimport type { Vault } from '../../kernel/vault.js'\nimport { sha256Hex } from '../../kernel/enclave/index.js'\nimport { ReadOnlyError } from '../../kernel/errors.js'\nimport { NOYDB_FORMAT_VERSION } from '../../kernel/types.js'\nimport { resolveAccessibleCollections, buildAccessibleBundle } from './export-accessible.js'\n\nexport const FROZEN_SNAPSHOTS_COLLECTION = '_frozen_snapshots'\nconst ENC = new TextEncoder()\n\n/** 24-hex-char random id (used for withdrawal ids + request ids). */\nexport function randomId(): string {\n  const b = globalThis.crypto.getRandomValues(new Uint8Array(12))\n  return Array.from(b, (x) => x.toString(16).padStart(2, '0')).join('')\n}\n\nexport interface FrozenSnapshotRef {\n  readonly withdrawalId: string\n  readonly sha256: string\n  readonly recordCount: number\n  readonly frozenAt: string\n}\n\nexport interface WithdrawAccessibleOptions {\n  /** Legal/contractual basis recorded in the audit (e.g. 'gdpr-art-17'). */\n  readonly legalBasis: string\n  /** Re-key the exported bundle to a new owner secret. */\n  readonly reKey?: { readonly secret: string }\n  /** Source disposition. Default 'delete'. */\n  readonly disposition?: 'delete' | 'freeze'\n  readonly scope?: { readonly collections?: readonly string[] }\n  /** Stable id for idempotent resume (default random). */\n  readonly withdrawalId?: string\n}\n\nexport interface WithdrawResult {\n  readonly bundle: Uint8Array\n  readonly snapshot?: FrozenSnapshotRef\n}\n\n/**\n * Freeze a write-once, hash-pinned snapshot of the current ciphertext for\n * `collections` WITHOUT touching the live records. Returns the snapshot ref.\n *\n * This is the non-destructive core shared by two callers:\n *  - `freezeAndDeleteClosure` (withdrawal, disposition `'freeze'`) — which\n *    pins the snapshot and THEN delete-closures the live records.\n *  - FR-6 `liberateVault` (custody) — which pins a PRE-liberation evidence\n *    snapshot but PRESERVES the live data for the new owner (operational\n *    continuity; liberation transfers, it does not erase).\n *\n * The snapshot put is write-once (CAS expectedVersion 0) and the ledger pin is\n * appended on success, so a crashed run re-run with the same `withdrawalId` is\n * safe. The snapshot is taken under the vault's own firm-owned DEKs — no re-key.\n */\nexport async function freezeSnapshotOnly(\n  vault: Vault,\n  collections: readonly string[],\n  opts: { actorUserId: string; withdrawalId?: string },\n): Promise<FrozenSnapshotRef> {\n  const { name: vaultName, adapter } = vault._introspectState()\n\n  // Enumerate the closure (record ids per collection).\n  const closure: Array<{ collection: string; id: string }> = []\n  for (const c of collections) {\n    for (const id of await adapter.list(vaultName, c)) closure.push({ collection: c, id })\n  }\n\n  const withdrawalId = opts.withdrawalId ?? `wd-${randomId()}`\n  const snap: Record<string, Record<string, unknown>> = {}\n  for (const { collection, id } of closure) {\n    const env = await adapter.get(vaultName, collection, id)\n    if (env) (snap[collection] ??= {})[id] = env\n  }\n  const frozenAt = new Date().toISOString()\n  const body = JSON.stringify({ withdrawalId, frozenAt, by: opts.actorUserId, collections: snap })\n  const sha = await sha256Hex(ENC.encode(body))\n  // Write-once: expectedVersion 0 rejects an overwrite (idempotent resume).\n  await adapter.put(\n    vaultName,\n    FROZEN_SNAPSHOTS_COLLECTION,\n    withdrawalId,\n    { _noydb: NOYDB_FORMAT_VERSION, _v: 1, _ts: frozenAt, _iv: '', _data: body, _by: opts.actorUserId },\n    0,\n  )\n  // Hash-pin into the tamper-evident ledger — makes the snapshot provably unaltered.\n  await vault._getLedgerOrNull()?.append({\n    op: 'lifecycle', collection: '', id: '', version: 0, actor: opts.actorUserId, payloadHash: '',\n    reason: `withdrawal-frozen-snapshot:${withdrawalId}:${sha}`,\n  })\n  return { withdrawalId, sha256: sha, recordCount: closure.length, frozenAt }\n}\n\n/**\n * Dispose of the source records for `collections`: optionally freeze a\n * write-once hash-pinned snapshot of the original ciphertext, then\n * delete-closure the live records. Returns the snapshot ref on freeze.\n *\n * Caller MUST have produced the portable bundle FIRST — this is destructive.\n * The delete is best-effort + idempotent (re-deleting an absent record is a\n * no-op) and the snapshot put is write-once (CAS expectedVersion 0), so a\n * crashed run re-run with the same `withdrawalId` is safe.\n */\nexport async function freezeAndDeleteClosure(\n  vault: Vault,\n  collections: readonly string[],\n  opts: { disposition: 'delete' | 'freeze'; actorUserId: string; withdrawalId?: string },\n): Promise<FrozenSnapshotRef | undefined> {\n  // freeze: pin a write-once, hash-pinned snapshot BEFORE any delete. The\n  // snapshot-only core is shared with FR-6 liberation (which never deletes).\n  const snapshot = opts.disposition === 'freeze'\n    ? await freezeSnapshotOnly(vault, collections, {\n        actorUserId: opts.actorUserId,\n        ...(opts.withdrawalId ? { withdrawalId: opts.withdrawalId } : {}),\n      })\n    : undefined\n\n  // delete-closure — only after the snapshot is durable.\n  const { name: vaultName, adapter } = vault._introspectState()\n  for (const c of collections) {\n    for (const id of await adapter.list(vaultName, c)) {\n      await vault.collection(c).delete(id)\n    }\n  }\n\n  return snapshot\n}\n\nexport async function withdrawAccessibleData(\n  vault: Vault,\n  opts: WithdrawAccessibleOptions,\n): Promise<WithdrawResult> {\n  const { keyring } = vault._introspectState()\n  const disposition = opts.disposition ?? 'delete'\n\n  // Owner-class roles hold blanket authority — they use extractPartition.\n  if (keyring.role === 'owner' || keyring.role === 'admin') {\n    throw new ReadOnlyError(\n      'unilateralWithdrawal is the scoped self-service path; an owner/admin should use extractPartition',\n    )\n  }\n  // FR-6: a custodian must NOT destructively SEVER the vault. It holds the DEKs\n  // and operates fully, but ownership is claimed only through the audited\n  // Liberate ceremony — never by a one-sided delete/freeze withdrawal. Fires\n  // BEFORE the operator rw-scope path below (where a custodian would otherwise\n  // be rejected with the wrong \"requires rw access\" message).\n  if (keyring.role === 'custodian') {\n    throw new ReadOnlyError(\n      'a custodian cannot destructively withdraw/sever; use vault.custody.liberate for an audited ownership claim',\n    )\n  }\n  // client/viewer are read-only by construction (see hasWritePermission): a\n  // destructive withdrawal they cannot self-serve — they use the two-party\n  // requestWithdrawal flow where firm authority executes the delete-closure.\n  if (keyring.role === 'client' || keyring.role === 'viewer') {\n    throw new ReadOnlyError(\n      'read-only role cannot self-serve a destructive withdrawal — use requestWithdrawal (two-party)',\n    )\n  }\n  // Operator path: destructive ops need rw on the whole scope.\n  const collections = resolveAccessibleCollections(keyring, opts.scope, true)\n  if (!collections || collections.length === 0) {\n    throw new ReadOnlyError(\n      'unilateralWithdrawal requires rw access on the withdrawn collections — use requestWithdrawal for read-only scope',\n    )\n  }\n\n  // 1. Produce the client's re-keyed portable copy FIRST (nothing destroyed yet).\n  const bundle = await buildAccessibleBundle(vault, collections, opts.reKey)\n\n  // 2. + 3. freeze (optional) then delete-closure.\n  const snapshot = await freezeAndDeleteClosure(vault, collections, {\n    disposition, actorUserId: keyring.userId, ...(opts.withdrawalId ? { withdrawalId: opts.withdrawalId } : {}),\n  })\n\n  // 4. audit\n  await vault._getLedgerOrNull()?.append({\n    op: 'lifecycle', collection: '', id: '', version: 0, actor: keyring.userId, payloadHash: '',\n    reason: `user-unilateral-withdrawal:${keyring.userId}:${disposition}:${opts.legalBasis}`,\n  })\n\n  return snapshot ? { bundle, snapshot } : { bundle }\n}\n"],"mappings":";;;;;;;;;;;;;;;AAwBO,IAAM,8BAA8B;AAC3C,IAAM,MAAM,IAAI,YAAY;AAGrB,SAAS,WAAmB;AACjC,QAAM,IAAI,WAAW,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AAC9D,SAAO,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AACtE;AAyCA,eAAsB,mBACpB,OACA,aACA,MAC4B;AAC5B,QAAM,EAAE,MAAM,WAAW,QAAQ,IAAI,MAAM,iBAAiB;AAG5D,QAAM,UAAqD,CAAC;AAC5D,aAAW,KAAK,aAAa;AAC3B,eAAW,MAAM,MAAM,QAAQ,KAAK,WAAW,CAAC,EAAG,SAAQ,KAAK,EAAE,YAAY,GAAG,GAAG,CAAC;AAAA,EACvF;AAEA,QAAM,eAAe,KAAK,gBAAgB,MAAM,SAAS,CAAC;AAC1D,QAAM,OAAgD,CAAC;AACvD,aAAW,EAAE,YAAY,GAAG,KAAK,SAAS;AACxC,UAAM,MAAM,MAAM,QAAQ,IAAI,WAAW,YAAY,EAAE;AACvD,QAAI,IAAK,EAAC,KAAK,UAAU,MAAM,CAAC,GAAG,EAAE,IAAI;AAAA,EAC3C;AACA,QAAM,YAAW,oBAAI,KAAK,GAAE,YAAY;AACxC,QAAM,OAAO,KAAK,UAAU,EAAE,cAAc,UAAU,IAAI,KAAK,aAAa,aAAa,KAAK,CAAC;AAC/F,QAAM,MAAM,MAAM,UAAU,IAAI,OAAO,IAAI,CAAC;AAE5C,QAAM,QAAQ;AAAA,IACZ;AAAA,IACA;AAAA,IACA;AAAA,IACA,EAAE,QAAQ,sBAAsB,IAAI,GAAG,KAAK,UAAU,KAAK,IAAI,OAAO,MAAM,KAAK,KAAK,YAAY;AAAA,IAClG;AAAA,EACF;AAEA,QAAM,MAAM,iBAAiB,GAAG,OAAO;AAAA,IACrC,IAAI;AAAA,IAAa,YAAY;AAAA,IAAI,IAAI;AAAA,IAAI,SAAS;AAAA,IAAG,OAAO,KAAK;AAAA,IAAa,aAAa;AAAA,IAC3F,QAAQ,8BAA8B,YAAY,IAAI,GAAG;AAAA,EAC3D,CAAC;AACD,SAAO,EAAE,cAAc,QAAQ,KAAK,aAAa,QAAQ,QAAQ,SAAS;AAC5E;AAYA,eAAsB,uBACpB,OACA,aACA,MACwC;AAGxC,QAAM,WAAW,KAAK,gBAAgB,WAClC,MAAM,mBAAmB,OAAO,aAAa;AAAA,IAC3C,aAAa,KAAK;AAAA,IAClB,GAAI,KAAK,eAAe,EAAE,cAAc,KAAK,aAAa,IAAI,CAAC;AAAA,EACjE,CAAC,IACD;AAGJ,QAAM,EAAE,MAAM,WAAW,QAAQ,IAAI,MAAM,iBAAiB;AAC5D,aAAW,KAAK,aAAa;AAC3B,eAAW,MAAM,MAAM,QAAQ,KAAK,WAAW,CAAC,GAAG;AACjD,YAAM,MAAM,WAAW,CAAC,EAAE,OAAO,EAAE;AAAA,IACrC;AAAA,EACF;AAEA,SAAO;AACT;AAEA,eAAsB,uBACpB,OACA,MACyB;AACzB,QAAM,EAAE,QAAQ,IAAI,MAAM,iBAAiB;AAC3C,QAAM,cAAc,KAAK,eAAe;AAGxC,MAAI,QAAQ,SAAS,WAAW,QAAQ,SAAS,SAAS;AACxD,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAMA,MAAI,QAAQ,SAAS,aAAa;AAChC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAIA,MAAI,QAAQ,SAAS,YAAY,QAAQ,SAAS,UAAU;AAC1D,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,cAAc,6BAA6B,SAAS,KAAK,OAAO,IAAI;AAC1E,MAAI,CAAC,eAAe,YAAY,WAAW,GAAG;AAC5C,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAGA,QAAM,SAAS,MAAM,sBAAsB,OAAO,aAAa,KAAK,KAAK;AAGzE,QAAM,WAAW,MAAM,uBAAuB,OAAO,aAAa;AAAA,IAChE;AAAA,IAAa,aAAa,QAAQ;AAAA,IAAQ,GAAI,KAAK,eAAe,EAAE,cAAc,KAAK,aAAa,IAAI,CAAC;AAAA,EAC3G,CAAC;AAGD,QAAM,MAAM,iBAAiB,GAAG,OAAO;AAAA,IACrC,IAAI;AAAA,IAAa,YAAY;AAAA,IAAI,IAAI;AAAA,IAAI,SAAS;AAAA,IAAG,OAAO,QAAQ;AAAA,IAAQ,aAAa;AAAA,IACzF,QAAQ,8BAA8B,QAAQ,MAAM,IAAI,WAAW,IAAI,KAAK,UAAU;AAAA,EACxF,CAAC;AAED,SAAO,WAAW,EAAE,QAAQ,SAAS,IAAI,EAAE,OAAO;AACpD;","names":[]}